Environment

Values live on Railway (backend) and Vercel (storefront). No secret belongs in this repository or in these docs.

Backend — Railway

Core

Variable	Notes
`DATABASE_URL`	Managed Postgres. Needs `ssl.rejectUnauthorized = false` in production.
`REDIS_URL`	Cache, event bus, workflow engine, locking
`JWT_SECRET`, `COOKIE_SECRET`	Session signing
`STORE_CORS`, `ADMIN_CORS`, `AUTH_CORS`	Must list every live domain
`MEDUSA_BACKEND_URL`	Inlined into the admin bundle at build time — changing it requires a redeploy, not a restart

Payments

Variable	Notes
`CURLEC_MODE`	`test` or `live`. Defaults to `live`.
`CURLEC_LIVE_KEY_ID`, `CURLEC_LIVE_KEY_SECRET`	Used when mode is `live`
`CURLEC_TEST_KEY_ID`, `CURLEC_TEST_KEY_SECRET`	Used when mode is `test`
`CURLEC_WEBHOOK_SECRET`	Separate from the API secret

Shipping

Variable	Notes
`EASYPARCEL_API_KEY`	Currently unset — this is what keeps EasyParcel off
`EASYPARCEL_ENV`	`demo` or `live`. Unset is treated as `demo`.

Unset, which is why only emailpass is registered. Each provider needs its own client id and secret before it appears on the login screen.

Storefront — Vercel

Variable	Notes
`NEXT_PUBLIC_MEDUSA_BACKEND_URL`	`https://api.autoxspare.com`
`NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY`	Store publishable key
`NEXT_PUBLIC_BASE_URL`	Drives canonical URLs, sitemap and JSON-LD. Set before pointing the apex domain.

vercel env add marks variables sensitive by default. A sensitive NEXT_PUBLIC_* cannot be read at build time, so the build silently falls back to a default and the wrong value ships without any error.

Scripts

Run with npx medusa exec ./src/scripts/<name>.ts from apps/backend. Several are dry-run by default and need an explicit flag to write:

Script	Guard
`enforce-myr.ts`	`MYR_APPLY=1`
`check-admin-users.ts`	`ADMIN_RESET_EMAIL` + `ADMIN_RESET_PASSWORD` to reset a password
`normalise-vehicles.ts`, `import-weights.ts`, `setup-shipping-my.ts`	See each file's header