# Configuration

Backend settings load from `backend/.env` with the `FS_` prefix ([Pydantic Settings](https://docs.pydantic.dev/latest/concepts/pydantic_settings/)). Core variables — mostly generated by `init.py`:

- `FS_APP_NAME` — application name
- `FS_MODE` — `b2c` or `b2b` (see [Multi-Tenancy](https://docs.fastsvelte.dev/features/multi-tenancy/index.md))
- `FS_ENVIRONMENT` — `dev`, `beta`, or `prod`
- `FS_DB_URL` / `FS_DB_SCHEMA` — database connection
- `FS_BASE_WEB_URL` / `FS_BASE_API_URL` — frontend and backend URLs
- `FS_JWT_SECRET_KEY` / `FS_CRON_SECRET` — auto-generated secrets

See the `.env.example` in each directory (`backend/`, `frontend/`, `landing/`, `backend/db/`) for the full list.

## Environment

```bash
FS_ENVIRONMENT="dev"        # dev | beta | prod — affects cookies, CORS, and defaults
FS_BASE_WEB_URL="http://localhost:5173"
FS_BASE_API_URL="http://localhost:8000"
```

CORS origins are derived per environment in `backend/app/config/settings.py` (`cors_origins`). Cookie security (`Secure`, `SameSite`) tightens automatically outside `dev` — see [Security](https://docs.fastsvelte.dev/features/security/index.md).

## Background jobs (cron)

Session cleanup and other scheduled work run via the cron endpoints, authenticated with a shared secret:

```bash
FS_CRON_SECRET="your-secure-cron-secret"
FS_CRON_SESSION_RETENTION_DAYS=7
```

## Rate limiting

Auth and email endpoints are rate limited out of the box (see [Security](https://docs.fastsvelte.dev/features/security/#rate-limiting)). Each container is a single process, so the in-memory default is fine for one instance; point at a shared store if you run multiple instances so the limit holds across them:

```bash
FS_RATE_LIMIT_STORAGE_URI="async+memory://"              # default; per-instance counters
# FS_RATE_LIMIT_STORAGE_URI="async+redis://host:6379/0"  # shared across instances (needs coredis)
```

## Integrations

Provider setup lives with each feature: [Email](https://docs.fastsvelte.dev/features/email/index.md), [Billing & Subscriptions](https://docs.fastsvelte.dev/features/billing/index.md), [Google OAuth](https://docs.fastsvelte.dev/features/google-oauth/index.md), and [AI](https://docs.fastsvelte.dev/features/ai/index.md).