Requirements

Required

• PostgreSQL 17+ — the primary database. Use an external provider (Supabase, Neon, or your own instance) or host it yourself; the server doesn't bundle one. Set DATABASE_URL to its connection string, which must start with postgres:// or postgresql:// — the server refuses to start with anything else.

• JWT_SECRET — the HMAC-HS256 secret used to sign access tokens. Generate one with:

  openssl rand -hex 32

• A container runtime — the documented deployment path (see Docker Compose Deployment) runs the official image with Docker and Docker Compose. Building the Go binary yourself with go build -o tabslate-server ./cmd/server is possible but not the documented path, and this guide doesn't cover it.

Leaving either DATABASE_URL or JWT_SECRET unset stops the server from starting at all — both are read as required environment variables at boot.

Optional

• Redis (REDIS_URL) — backs real-time sync pub/sub across multiple server instances, per-IP/per-user rate limiting, and session/cache storage. Leave it unset and the server falls back to in-memory implementations of all three, which is correct and sufficient for a single instance; the fallback stops being enough only once you run more than one server instance, since in-memory state isn't shared between them.
• Email provider (MAIL_PROVIDER) — smtp, resend, or ses. Required only if you want registration to require email verification or want a working "forgot password" flow. Leave it unset and new registrations are auto-verified immediately with no OTP email sent at all.
• MeiliSearch (MEILISEARCH_HOST, MEILISEARCH_API_KEY) — powers GET /search for bookmark full-text search. Leave it unset and that endpoint stays reachable but always returns an empty result list rather than erroring.
• Prosopo CAPTCHA (PROSOPO_SECRET) — bot protection on registration, login, and OTP requests. Leave it unset and captcha verification is skipped entirely (every token is accepted).

Registration limit on OSS instances

An OSS instance registers new accounts until it has 3 verified users, at which point further registrations are refused until an existing account is removed. There is currently no environment variable that raises this limit — it fits a personal or small-team self-hosting instance rather than one meant to onboard an unbounded number of users. This limit doesn't apply to TabSlate Cloud, which uses a different billing provider.

See Environment Configuration for the complete grouped list of variables, including rate-limit tuning and defaults.