Deploy
Environment variables
Every setting in the server .env file.
The server reads /var/www/lokipay/.env. Generate secrets with openssl rand -hex 32.
| Variable | Required | Description |
|---|---|---|
POSTGRES_PASSWORD | yes | Database password (used by both containers). |
PUBLIC_URL | yes | Public HTTPS URL, e.g. https://pay.yourshop.com. Used in pairing QR codes, checkoutUrl and payment-link URLs. |
WEBHOOK_SECRET | yes | Signs outgoing webhooks (X-LokiPay-Signature). Give the same value to your backend. |
DEVICE_SECRET_KEY | yes | Encrypts each relay phone’s signing secret at rest. Changing it un-pairs every phone. |
ADMIN_EMAIL | first run | Email of the first admin (created only if no admin exists). |
ADMIN_PASSWORD | first run | Password of the first admin. Change it after signing in. |
BRAND_NAME | no | Default business name (default LokiPay). Editable in Settings → Branding. |
WEBHOOK_URL | no | Default webhook endpoint. Usually set in Settings → Webhook instead. |
MERCHANT_API_KEY | no | A fixed API key (≥ 32 characters). Prefer generating one in Settings → API keys, which is stored hashed and can be rotated. |
COOKIE_SECURE | no | Default true. Only set false for local development over plain HTTP. |
NODE_ENV | no | production on servers. |
Keep .env on the server
deploy.sh never uploads a local .env. Do not commit secrets. If WEBHOOK_SECRET leaks, change it here and in your backend at the same time.