Environment Configuration
Stadium 8 keeps environment-specific settings, such as your backend’s address, in a local file called web/.env.local. This page explains the file, its variables, and what to watch out for.
The configuration file
Section titled “The configuration file”web/.env.local is created from web/.env.example the first time dependencies are installed. It stays on your machine: the repository’s .gitignore excludes it, so it’s never committed.
web/.env.example is committed. It lists the variables the app needs, with placeholder values.
Restart the dev server after you change web/.env.local. The app reads the file when it starts.
Variables you may need
Section titled “Variables you may need”| Variable | What it does |
|---|---|
NEXT_PUBLIC_API_BASE_URL | The address of your backend API. The default is http://localhost:8042. |
NEXT_PUBLIC_USE_MOCK_API | Set to true to use the mock backend. Claude adds it when it builds the mock, and /api-go-live removes it. |
NEXT_PUBLIC_API_AUTH_HEADER | The header your backend reads the credential from, such as Authorization or X-API-Key |
NEXT_PUBLIC_API_AUTH_VALUE_PREFIX | Text placed before the credential, such as Bearer with its trailing space. Leave it empty for a plain API key. |
NEXT_PUBLIC_API_TOKEN | The credential itself |
The three credential variables are only needed if your backend requires one. When your OpenAPI spec declares authentication, Intake adds them to web/.env.local as commented-out placeholders for you to fill in.
Your project may also have server-side variables, such as the backend addresses a Backend for Frontend uses. Their names don’t start with NEXT_PUBLIC_.
A warning about NEXT_PUBLIC_ variables
Section titled “A warning about NEXT_PUBLIC_ variables”Any variable whose name starts with NEXT_PUBLIC_ is built into the app’s browser code. Anyone who opens the deployed app can read it in the JavaScript, in network requests, or in the browser’s developer tools.
Don’t put secrets in NEXT_PUBLIC_* variables in production. The credential variables above are meant for local development against a development backend. For a production app that uses sensitive tokens, choose the Backend for Frontend sign-in option, so the token stays on the server.
What’s handled for you
Section titled “What’s handled for you”web/.env.localis created when dependencies are first installed- Intake records your backend’s address and adds any credential placeholders
- Claude adds
NEXT_PUBLIC_USE_MOCK_APIwhen it builds a mock /api-go-liveswitches the app from the mock to your real backend/api-statusshows the current connection state
You’ll normally only edit web/.env.local yourself to fill in credentials, or when you set up a fresh clone of the repository on another machine.
Keeping secrets safe
Section titled “Keeping secrets safe”- Don’t share
web/.env.localin a chat, email or document. Use your team’s password manager. - Don’t commit it. Anything committed stays in the repository’s history, even if you delete it later.