Skip to content

dx(frontend): Update .env.default #11280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pwuts wants to merge 2 commits into
base: dev
Choose a base branch
from
+21 −13
Open

dx(frontend): Update .env.default #11280

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2d3a5df
dx(frontend): Fix .env.default
Pwuts Oct 28, 2025
f5037c3
Merge branch 'dev' into pwuts/fix-frontend-default-env
0ubbe Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 21 additions & 13 deletions autogpt_platform/frontend/.env.default
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,26 @@
NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
NEXT_PUBLIC_AGPT_SERVER_URL=http://localhost:8006/api
NEXT_PUBLIC_AGPT_WS_SERVER_URL=ws://localhost:8001/ws
NEXT_PUBLIC_FRONTEND_BASE_URL=http://localhost:3000
AUTH_CALLBACK_URL="${NEXT_PUBLIC_FRONTEND_BASE_URL}/auth/callback"
Copy link

@sentry sentry bot Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: AUTH_CALLBACK_URL in .env.default uses unsupported variable expansion, resulting in an invalid literal string for OAuth callbacks.
Severity: HIGH | Confidence: 0.95

🔍 Detailed Analysis

The AUTH_CALLBACK_URL in .env.default is defined with variable syntax like ${NEXT_PUBLIC_FRONTEND_BASE_URL}/auth/callback. The dotenv library (v17.2.1) and current Next.js configuration do not support shell-style variable expansion. Consequently, AUTH_CALLBACK_URL is set to the literal string "${NEXT_PUBLIC_FRONTEND_BASE_URL}/auth/callback". This invalid URL is then used for OAuth redirects, causing authentication failures in local development environments. The fallback http://localhost:3000/auth/callback is not utilized because AUTH_CALLBACK_URL is technically defined.

💡 Suggested Fix

Either hardcode AUTH_CALLBACK_URL to http://localhost:3000/auth/callback in .env.default or implement dotenv variable expansion support (e.g., via dotenv-expand or @next/env configuration).

🤖 Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: autogpt_platform/frontend/.env.default#L4

Potential issue: The `AUTH_CALLBACK_URL` in `.env.default` is defined with variable
syntax like `${NEXT_PUBLIC_FRONTEND_BASE_URL}/auth/callback`. The `dotenv` library
(v17.2.1) and current Next.js configuration do not support shell-style variable
expansion. Consequently, `AUTH_CALLBACK_URL` is set to the literal string
`"${NEXT_PUBLIC_FRONTEND_BASE_URL}/auth/callback"`. This invalid URL is then used for
OAuth redirects, causing authentication failures in local development environments. The
fallback `http://localhost:3000/auth/callback` is not utilized because
`AUTH_CALLBACK_URL` is technically defined.

Did we get this right? 👍 / 👎 to inform future reviews.

Copy link
Contributor

@0ubbe 0ubbe Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Pwuts this could be an issue?


NEXT_PUBLIC_AGPT_SERVER_URL=http://localhost:8006/api
NEXT_PUBLIC_AGPT_WS_SERVER_URL=ws://localhost:8001/ws
NEXT_PUBLIC_FRONTEND_BASE_URL=http://localhost:3000
NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE

NEXT_PUBLIC_APP_ENV=local
NEXT_PUBLIC_BEHAVE_AS=LOCAL
# When running locally, set NEXT_PUBLIC_BEHAVE_AS=CLOUD to use the a locally hosted marketplace (as is typical in development, and the cloud deployment), otherwise set it to LOCAL to have the marketplace open in a new tab
NEXT_PUBLIC_APP_ENV=local
NEXT_PUBLIC_BEHAVE_AS=LOCAL

NEXT_PUBLIC_LAUNCHDARKLY_ENABLED=false
NEXT_PUBLIC_LAUNCHDARKLY_CLIENT_ID=687ab1372f497809b131e06e
## LaunchDarkly configuration
NEXT_PUBLIC_LAUNCHDARKLY_ENABLED=false
NEXT_PUBLIC_LAUNCHDARKLY_CLIENT_ID=687ab1372f497809b131e06e

NEXT_PUBLIC_TURNSTILE=disabled
NEXT_PUBLIC_REACT_QUERY_DEVTOOL=true
## Cloudflare Turnstile (CAPTCHA) Configuration
## Get these from the Cloudflare Turnstile dashboard: https://dash.cloudflare.com/?to=/:account/turnstile
## This is the frontend site key
NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY=
NEXT_PUBLIC_TURNSTILE=disabled

NEXT_PUBLIC_GA_MEASUREMENT_ID=G-FH2XK2W4GN

# Devtools
NEXT_PUBLIC_REACT_QUERY_DEVTOOL=true

NEXT_PUBLIC_GA_MEASUREMENT_ID=G-FH2XK2W4GN