---
title: Configure a self-hosted site
description: Set only the environment variables needed for a self-hosted Thally site or local authoring workflow.
url: https://pr-7-a9c4e9fe1b6c.thally.app/guides/environment-variables
---

# Configure a self-hosted site

Set only the environment variables needed for a self-hosted Thally site or local authoring workflow.

> **Note:**
Managed sites receive their configuration from Thally Cloud. Use the site's
**Settings** pages instead of adding environment variables.

Use this reference only when you host the open-source runtime yourself or run
AI authoring tools locally. Store secrets in `.env.local` during development
and in your hosting provider's secret manager in production. Never commit real
values.

## Required for production

| Variable | When you need it | Purpose |
| --- | --- | --- |
| `THALLY_SITE_URL` | Every self-hosted production site | Sets the public origin for canonical URLs, social metadata, sitemaps, and agent endpoints. |

## Connect a self-hosted site to Thally Cloud

| Variable | When you need it | Purpose |
| --- | --- | --- |
| `THALLY_CLOUD_SITE_TOKEN` | When you connect a self-hosted site to Cloud services | Server-only credential issued once from **Settings → Connection**. Never expose it through a `NEXT_PUBLIC_` variable. |

Rotate or revoke this token from Thally Cloud. Managed sites do not use it.

## Protect the admin area and private docs

| Variable | When you need it | Purpose |
| --- | --- | --- |
| `THALLY_ADMIN_PASSWORD` | Shared-password access to `/admin` | Grants Owner access. Use a long random value. |
| `THALLY_ADMIN_SECRET` | A separate admin signing secret | Optional; defaults to the admin password. |
| `THALLY_ACCESS_PASSWORD` | Shared visitor access | Requires readers to enter a password before opening the docs. |
| `THALLY_AUTH_SECRET` | OIDC team sign-in | Signs admin sessions. |
| `THALLY_OIDC_ISSUER` | OIDC team sign-in | OpenID Connect issuer URL. |
| `THALLY_OIDC_CLIENT_ID` | OIDC team sign-in | OIDC client identifier. |
| `THALLY_OIDC_CLIENT_SECRET` | OIDC team sign-in | OIDC client secret. |

See [Manage the built-in site admin](/guides/admin-dashboard) for the setup and
callback URL.

## Keep self-hosted state after a redeploy

Serverless filesystems are temporary. Add remote storage before you depend on
saved settings or analytics.

| Variable | When you need it | Purpose |
| --- | --- | --- |
| `THALLY_DATABASE_URL` | Durable site settings | Remote libSQL database URL. |
| `THALLY_DATABASE_TOKEN` | With `THALLY_DATABASE_URL` | Authentication token for the database. |
| `THALLY_ANALYTICS_DB_URL` | Durable self-hosted analytics | Remote libSQL analytics database URL. |
| `THALLY_ANALYTICS_DB_TOKEN` | With `THALLY_ANALYTICS_DB_URL` | Authentication token for the analytics database. |

## Run AI authoring tools locally

These variables apply to local docs-agent, migration, or translation commands.
They do not enable AI answers on a deployed site.

| Variable | When you need it | Purpose |
| --- | --- | --- |
| `ANTHROPIC_API_KEY` | Local AI commands | Model provider key. Keep it in your local environment or authoring workflow. |
| `THALLY_AGENT_MODEL` | Optional model override | Selects the model used by the local docs agent. |

Self-managed GitHub automation has its own repository secrets. Follow the
[docs-agent setup](/guides/docs-agent#automate-review-gated-drafts) instead of copying platform
credentials into the docs runtime.

## Verify the change

Restart the development server or redeploy after changing configuration. Test
the feature you enabled, then check server logs without printing secret values.

## Next steps

- [Deploy your documentation](/guides/deploying)
- [Protect private documentation](/guides/private-docs)
- [Manage the built-in site admin](/guides/admin-dashboard)