Environment variables

Variable	Required	Purpose
`NEXT_PUBLIC_AZURE_CLIENT_ID`	Yes	Entra application (client) ID
`AZURE_CLIENT_SECRET`	Yes (prod / silent refresh)	Confidential client secret
`NEXT_PUBLIC_APP_URL` / `APP_URL`	Yes	Canonical origin for links and redirects
`UPSTASH_REDIS_REST_URL`	Yes	Redis REST endpoint
`UPSTASH_REDIS_REST_TOKEN`	Yes	Redis token (also may sign cookies)
`UPLOAD_ACCESS_SECRET`	Recommended in prod	Dedicated cookie signing secret
`ALLOWED_ADMIN_EMAILS`	Recommended	Comma/newline list of admin emails
`AZURE_AUTHORITY`	Optional	Default `https://login.microsoftonline.com/common`
`ONEDRIVE_REDIRECT_URI`	Optional	Narrow registered redirect URI
`BLOB_READ_WRITE_TOKEN` / `BLOB_STORE_ID`	Vercel	Persist MSAL OneDrive token cache
`ONEDRIVE_CACHE_PATH`	Optional local	Override local token cache path
`AZURE_COMMUNICATION_SERVICES_CONNECTION_STRING`	For email	ACS connection string
`AZURE_EMAIL_SENDER_ADDRESS`	For email	Verified MailFrom address

Email setup reminder

Connection string comes from the Communication Services resource → Settings → Keys.

The Email Communication Services resource has no keys; its domain must be connected under Communication Services → Email → Domains. Mismatched sender domains produce DomainNotLinked.

Redirect URIs to register in Entra


{APP_URL}/api/auth/onedrive/callback
{APP_URL}/api/auth/upload-access/callback

Local development


npm install
# Create .env.local with Azure, Upstash, and optional ACS variables
npm run dev

Useful scripts: npm run build, npm start, npm run lint, npm run typecheck, npm run format.

Local LAN testing: next.config.ts may list allowedDevOrigins (for example a machine LAN IP) so phones can load HMR assets during next dev.