Operating

Security & authentication

These variables configure browser access, local authentication, and encryption for Plane.

CORS_ORIGINS=http://localhost:8080,http://localhost:3001
JWT_SECRET=thisisasecret
BLNK_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef

CORS_ORIGINSrequired

Comma-separated list of browser origins allowed to call the Plane API. Do not include spaces. Include ENTERPRISE_PUBLIC_URL so the Cloud Dashboard can reach the API.

JWT_SECRETrequired

Strong random secret used to sign and verify local authentication tokens. Store this as a secret and keep it stable across restarts.

BLNK_ENCRYPTION_KEYrequired

Unique 32-character key used to encrypt sensitive data, including instance connection keys. Do not change it after deployment because existing encrypted data may become unreadable.