Env and Config Generator for AI Apps

Pick the features your app has and take away an .env.example, a validating config loader, and an audit of the .env you already have.

PrefixEvery variable is namespaced with it, so nothing collides with another service's.

ProvidersComma-separated names of your own choosing. One key, base URL and model per provider.

Loader style

An .env you already have (optional)Checked against the set above and never stored, sent or echoed back. Do not paste production secrets into any web page as a habit — this one runs entirely in your browser, and the next one might not.

Variables generated

5 required, 18 with a default, 2 that must come from a secret store rather than from a file.

Providers configured: 2
Required variables: 5
Optional variables: 18
Secrets: 2
Variables missing from the .env you pasted: —
Values that look like live credentials: —

.env.example — commit this oneRead-only. Select all and copy.

# Generated by /tools/config-generator. Every value below is a PLACEHOLDER.
# Commit this file. Never commit the .env it becomes.

# The credential for primary. It belongs in your secret store and in .env.local, never in .env.example and never in git.
# Required. Secret — put the real value in your secret store.
MYAPP_PRIMARY_API_KEY=REPLACE_ME

# Overridable so tests and local development can point at a mock instead of primary. Empty means the SDK default.
# Optional.
MYAPP_PRIMARY_BASE_URL=https://api.example.com/v1

# The model id, in config rather than in code, so changing model is a deploy and not a release.
# Required.
MYAPP_PRIMARY_MODEL=replace-with-a-model-id

# The credential for backup. It belongs in your secret store and in .env.local, never in .env.example and never in git.
# Required. Secret — put the real value in your secret store.
MYAPP_BACKUP_API_KEY=REPLACE_ME

# Overridable so tests and local development can point at a mock instead of backup. Empty means the SDK default.
# Optional.
MYAPP_BACKUP_BASE_URL=https://api.example.com/v1

# The model id, in config rather than in code, so changing model is a deploy and not a release.
# Required.
MYAPP_BACKUP_MODEL=replace-with-a-model-id

# How long one call may take before you give up. A starting point only: measure your own p99 and set this above it, because a timeout below your real tail turns slow requests into failed ones.
# Optional.
MYAPP_REQUEST_TIMEOUT_MS=60000

# The ceiling on one response. This is the field that bounds the cost of a single request, and the one most often left at a default that is ten times what the feature needs.
# Required.
MYAPP_MAX_OUTPUT_TOKENS=1024

# In-flight requests per process. Derive it from your provider limit rather than from a hunch — too high and you buy 429s, too low and you queue for nothing.
# Optional.
MYAPP_MAX_CONCURRENCY=8

# Whether responses stream. Worth a flag because streaming changes error handling: a failure after the first token cannot be retried transparently.
# Optional.
MYAPP_STREAMING=true

# How long a stream may go silent before you treat it as dead. Separate from the request timeout, because a long answer is not a hung one.
# Optional.
MYAPP_STREAM_IDLE_TIMEOUT_MS=20000

# Total attempts including the first. Every attempt above one multiplies your load on a service that is already failing.
# Optional.
MYAPP_MAX_ATTEMPTS=4

# The first backoff delay; subsequent ones multiply. Jitter belongs in the code, not in config.
# Optional.
MYAPP_RETRY_BASE_MS=500

# Your own client-side ceiling, set below the provider's so you find out from your own limiter rather than from a 429.
# Optional.
MYAPP_RATE_LIMIT_RPM=600

# Requests that may arrive at once without waiting. The bucket capacity.
# Optional.
MYAPP_RATE_LIMIT_BURST=60

# Where to go when the primary is unavailable. Empty disables fallback — which is a valid choice, and better than a fallback nobody has tested.
# Optional.
MYAPP_FALLBACK_MODEL=replace-with-a-model-id

# Which failures are worth failing over on. A 400 is not: it will be a 400 on the other model too.
# Optional.
MYAPP_FALLBACK_ON=429,500,502,503,504,timeout

# debug | info | warn | error.
# Optional.
MYAPP_LOG_LEVEL=info

# Whether prompt text is written to logs. Default false and mean it: prompts contain whatever your users typed, which is the definition of personal data in most of the world.
# Optional.
MYAPP_LOG_PROMPTS=false

# Stop spending above this in a day. The only defence against a loop that retries a 200k-token prompt for six hours before anyone notices.
# Optional.
MYAPP_DAILY_COST_CAP_USD=50

# degrade | reject | alert. Decide it now, in daylight, rather than at the moment the cap trips.
# Optional.
MYAPP_COST_CAP_ACTION=degrade

# Pins temperature to 0 and disables the cache, so an eval run measures the model rather than the cache hit rate.
# Optional.
MYAPP_EVAL_MODE=false

# Recorded with every result. Without it you cannot tell whether last month's eval scores were a different model or a different prompt.
# Optional.
MYAPP_PROMPT_VERSION=2026-08-03.1

config.tsRead-only. Select all and copy.

import { z } from "zod";

/* Parsed once, at startup. The point of failing here rather than at the first
   request is that a missing key becomes a crash on deploy, which you see, and
   not a 500 at 3am for one unlucky user. */
const schema = z.object({
  MYAPP_PRIMARY_API_KEY: z.string().min(1),
  MYAPP_PRIMARY_BASE_URL: z.string().default("https://api.example.com/v1"),
  MYAPP_PRIMARY_MODEL: z.string().min(1),
  MYAPP_BACKUP_API_KEY: z.string().min(1),
  MYAPP_BACKUP_BASE_URL: z.string().default("https://api.example.com/v1"),
  MYAPP_BACKUP_MODEL: z.string().min(1),
  MYAPP_REQUEST_TIMEOUT_MS: z.coerce.number().default(60000),
  MYAPP_MAX_OUTPUT_TOKENS: z.coerce.number(),
  MYAPP_MAX_CONCURRENCY: z.coerce.number().default(8),
  MYAPP_STREAMING: z.enum(["true", "false"]).default("true").transform((x) => x === "true"),
  MYAPP_STREAM_IDLE_TIMEOUT_MS: z.coerce.number().default(20000),
  MYAPP_MAX_ATTEMPTS: z.coerce.number().default(4),
  MYAPP_RETRY_BASE_MS: z.coerce.number().default(500),
  MYAPP_RATE_LIMIT_RPM: z.coerce.number().default(600),
  MYAPP_RATE_LIMIT_BURST: z.coerce.number().default(60),
  MYAPP_FALLBACK_MODEL: z.string().default("replace-with-a-model-id"),
  MYAPP_FALLBACK_ON: z.string().default("429,500,502,503,504,timeout"),
  MYAPP_LOG_LEVEL: z.string().default("info"),
  MYAPP_LOG_PROMPTS: z.enum(["true", "false"]).default("false").transform((x) => x === "true"),
  MYAPP_DAILY_COST_CAP_USD: z.coerce.number().default(50),
  MYAPP_COST_CAP_ACTION: z.string().default("degrade"),
  MYAPP_EVAL_MODE: z.enum(["true", "false"]).default("false").transform((x) => x === "true"),
  MYAPP_PROMPT_VERSION: z.string().default("2026-08-03.1"),
});

const parsed = schema.safeParse(process.env);
if (!parsed.success) {
  console.error("Bad configuration:\n" + JSON.stringify(parsed.error.flatten().fieldErrors, null, 2));
  process.exit(1);
}

export const config = {
  primaryApiKey: parsed.data.MYAPP_PRIMARY_API_KEY,
  primaryBaseUrl: parsed.data.MYAPP_PRIMARY_BASE_URL,
  primaryModel: parsed.data.MYAPP_PRIMARY_MODEL,
  backupApiKey: parsed.data.MYAPP_BACKUP_API_KEY,
  backupBaseUrl: parsed.data.MYAPP_BACKUP_BASE_URL,
  backupModel: parsed.data.MYAPP_BACKUP_MODEL,
  requestTimeoutMs: parsed.data.MYAPP_REQUEST_TIMEOUT_MS,
  maxOutputTokens: parsed.data.MYAPP_MAX_OUTPUT_TOKENS,
  maxConcurrency: parsed.data.MYAPP_MAX_CONCURRENCY,
  streaming: parsed.data.MYAPP_STREAMING,
  streamIdleTimeoutMs: parsed.data.MYAPP_STREAM_IDLE_TIMEOUT_MS,
  maxAttempts: parsed.data.MYAPP_MAX_ATTEMPTS,
  retryBaseMs: parsed.data.MYAPP_RETRY_BASE_MS,
  rateLimitRpm: parsed.data.MYAPP_RATE_LIMIT_RPM,
  rateLimitBurst: parsed.data.MYAPP_RATE_LIMIT_BURST,
  fallbackModel: parsed.data.MYAPP_FALLBACK_MODEL,
  fallbackOn: parsed.data.MYAPP_FALLBACK_ON,
  logLevel: parsed.data.MYAPP_LOG_LEVEL,
  logPrompts: parsed.data.MYAPP_LOG_PROMPTS,
  dailyCostCapUsd: parsed.data.MYAPP_DAILY_COST_CAP_USD,
  costCapAction: parsed.data.MYAPP_COST_CAP_ACTION,
  evalMode: parsed.data.MYAPP_EVAL_MODE,
  promptVersion: parsed.data.MYAPP_PROMPT_VERSION,
} as const;

What this assumes: every number in the generated file is a CONVENTIONAL STARTING POINT and not a recommendation: a 60-second timeout, four attempts, eight concurrent requests and a 1024-token ceiling are values that will not embarrass you on day one and that you are expected to replace with measurements from your own traffic. Nothing here has measured your latency, your failure rate or your token distribution, and no generator can. Every example value is a placeholder — REPLACE_ME, replace-with-a-model-id — because a generator that emitted a plausible-looking key would eventually have one committed. Everything on this page runs in your browser. Nothing you paste or open is uploaded, logged or sent anywhere.

The reason to lift these values out of the code is not tidiness, it is that every one of them is something you will want to change without a release: the model id when a better one appears, the token ceiling when the bill arrives, the timeout when the p99 moves. The reason to validate them at startup is that the alternative is discovering a missing key when a user hits the feature, which is both later and quieter than it should be.

The two variables that are not like the others

MAX_OUTPUT_TOKENS is the only line that bounds what a single request can cost, and it is usually left at whatever the SDK defaults to — which is generous, because the SDK does not know what your feature does. A daily cost cap is the only line that bounds what a loop can cost; without it a retry storm against a large prompt runs until someone reads a dashboard. Both are cheap to set and are the two most common items missing from a config that later needed an incident write-up.

Prompts are user data

LOG_PROMPTS defaults to false here on purpose. Prompt text contains whatever your users typed, which in most jurisdictions makes your log aggregator a processor of personal data. Turning it on for a debugging session is reasonable; leaving it on is a decision that should be made deliberately, by someone who knows it was made.

Env and Config Generator for AI Apps

The two variables that are not like the others

Prompts are user data

The reasoning behind this

Related tools