Environment variables

Variable	Sets	Unset means
DOCS_SSO_URL	Where a reader is redirected to sign in — your product’s SSO endpoint.	Together with the two below, the logged-in tier is off: Log in doesn’t render, and /private/** answers 404 in production (a setup page under astro dev).
DOCS_SSO_SECRET	Verifies the handoff JWT your product signs.	Same as above.
DOCS_SESSION_SECRET	Signs this site’s own session cookie.	Same as above.
DOCS_UNSAFE_DEMO_LOGIN	Set to 1 or true — nothing else counts — to turn /demo-login into an open persona picker. See Trying it without SSO.	/demo-login answers the same 404 as the rest of the auth surface — the safe default on anything with real private content.
DOCS_SITE_URL	The deployed URL, used by the sitemap and llms.txt to emit absolute links.	Falls back to the https://example.com placeholder hardcoded in astro.config.mjs — set one or the other before shipping.
DOCS_TEST_PORT	Port the browser test suite’s site server listens on, for npm run test:visual.	Defaults to 4331.

Note

DOCS_SSO_URL, DOCS_SSO_SECRET, DOCS_SESSION_SECRET and DOCS_UNSAFE_DEMO_LOGIN are read at runtime (access: 'secret' in astro.config.mjs’s env.schema), not baked into the build — one build works across environments. DOCS_SITE_URL is different: it’s read once at build time, so a new value means a new build.

PORT and HOST configure the standalone Node server itself (@astrojs/node), not this template — see Deploy. VERCEL is set by Vercel’s own build system to pick the adapter automatically; nothing to set yourself.