🚩Feature flags & environment
The environment settings a self-hosted Dapta Forms deployment can change that your users actually notice: demo form seeding, premium features, the Made with Dapta Forms badge, deployment wide tracking
A self-hosted deployment is configured entirely through environment variables. Most of them are plumbing, meaning database, ports and secrets, and are covered in Self-hosting. This page lists the ones that change what people see, so you can tell why your instance behaves differently from forms.dapta.ai.
None of these apply to the hosted product: on forms.dapta.ai these choices are already made for you.
⚠️ Note: Anything starting with
NEXT_PUBLIC_is a build time value, baked into the web image when you build it. Changing it means rebuilding and redeploying the web image, not restarting a container.
New workspaces
SEED_DEMO_FORM
true
Whether a brand new workspace starts with a ready made demo form to poke at, or an empty Forms list. Set it to false to ship empty workspaces. Other first run settings can take precedence over it: .env.example spells out the exact interaction.
Premium features
Dapta Forms itself is free and has no plans to unlock. The gate exists only so a deployment can put its own entitlements in front of the optional extras.
PREMIUM_FEATURES
open
open unlocks everything, which is what a fork gets and what you almost certainly want. locked checks each feature against an entitlement service instead.
ENTITLEMENTS_API_URL
unset
Required only when PREMIUM_FEATURES=locked: the service that answers the entitlement check.
ENTITLEMENTS_API_KEY
unset
The credential for that service. Required only when PREMIUM_FEATURES=locked.
Naming and cross links
NEXT_PUBLIC_PRODUCT_NAME
Forms
The product name shown around the UI.
NEXT_PUBLIC_PLATFORM_URL
empty
Adds the platform row to the app switcher. Unset renders neither it nor the platform navigation item.
NEXT_PUBLIC_CALENDARS_URL
empty
Adds a calendars link to the app switcher.
Deployment wide tracking IDs
These are the marketing tags rendered on public form pages only, never in the dashboard. Each tag loads only when its ID is set, so a deployment with all of them unset makes zero third-party requests. They are defaults for the whole deployment, and a form's own settings under Connect override them per form. See Tracking & pixels.
NEXT_PUBLIC_GTM_ID
Loads a Google Tag Manager container on every public form page.
NEXT_PUBLIC_META_PIXEL_ID
Fires one Meta Pixel PageView per visit.
NEXT_PUBLIC_POSTHOG_KEY
Captures one PostHog pageview per visit.
NEXT_PUBLIC_POSTHOG_HOST
The PostHog ingestion URL. Defaults to PostHog US cloud, so set it for an EU or self-hosted project.
NEXT_PUBLIC_HUBSPOT_TRACKING_ID
Loads the HubSpot tracking code for your portal on public form pages.
⚠️ Note: These tags belong to the form owner and measure their respondents. They are not your deployment's own product analytics, which is a separate set of variables with deliberately different names so the two can never be pointed at the same key.
Nothing is emailed until you choose a provider. Until then, submission notices are written to the API log, so a fresh deployment still runs end to end.
EMAIL_PROVIDER
log-only
log-only prints notices to the log, noop drops them silently, smtp sends over SMTP, http posts each message to a mail API. Until this is set, submission emails never arrive.
MAIL_FROM_EMAIL
forms@example.com
The sender address on every email. Change it before you send anything real.
MAIL_FROM_NAME
Forms
The sender name shown in the inbox.
Rate limits and destinations
RATE_LIMIT_ENABLED
true
Whether the public form and submission endpoints are throttled at all.
RATE_LIMIT_CAPACITY
60
The burst allowance per client IP address.
TRUST_PROXY_HOPS
1 when a public URL is set, else 0
How many trusted proxies sit in front of the API. Set it wrong and every visitor shares one bucket, so real respondents start seeing throttle errors.
HUBSPOT_PRIVATE_APP_TOKEN
unset
Set it and HubSpot works for the whole deployment: the Connections page shows Provided by the server instead of asking each account to connect. Unset, the HubSpot card reports a clear disabled state.
Where the full list lives
These are the user visible ones. The complete reference, including every secret, port and database setting, lives in the repository:
.env.example: every variable with its default and an inline explanation of what it does.SELF-HOSTING.md: the same variables grouped by concern, with the ones that are required for a real deployment called out.
Server settings are validated when the API starts. A bad value stops the boot with a message naming the variable and the reason, rather than starting up in a broken state.
What's next
Self-hosting: the deployment itself.
Public API & rate limits: what the throttle settings above actually do.
Tracking & pixels: the per form version of the tracking IDs.
Last updated