Optional Integrations
Turnstile bot check and the general shape of everything else that's optional.
Past the secret key base, email, and billing, everything else the kit talks to is genuinely optional, and every one of them follows the same adapter+fake shape: absent credentials mean a deterministic fake stands in, and the feature it's part of still works end to end. See The Adapter+Fake Pattern for the mechanism behind this.
Bot check: Cloudflare Turnstile
TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY. Off by default, meaning a no-op that always
passes; once both are set, the Turnstile widget renders on the sign-in form and every submission is
verified against Cloudflare before a code is sent.
S3-compatible object storage
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, S3_BUCKET, S3_REGION, and S3_ENDPOINT for a
non-AWS provider like Cloudflare R2. Without these, Active Storage falls back to local disk. See
Production Database and Storage.
APP_HOST
Your production hostname. This one isn't a third-party credential, but it belongs in the same "set it before you rely on production behaving correctly" category: it's what canonical URLs, the sitemap, and the feeds use to build absolute links, and mailer links read it too.
Mobile: App Store and Play Store
Shipping the native apps needs an Apple Developer Program membership ($99/year), a Google Play Console account ($25 one time), signing certificates or a keystore, and, if you're offering in-app purchases, StoreKit and Play Billing product setup in each store's console. None of this is needed to develop or even deploy the web app; it's specific to the mobile shells. See Mobile Overview.
The pattern, if you're adding your own key
Every credential in the app resolves from ENV first, then Rails encrypted credentials as a
fallback, and every integration built around a credential has a fake that runs without it. If
you're wiring up a new third-party service yourself, follow the same shape; see
The add-integration Skill.
Next
You've now covered the full credential reference. See how to pull kit updates into your product without losing your own work: Pulling Kit Updates.
