Past the secret key base, email, and billing, everything else the kit talks to is genuinely
optional, and every one of them follows the same adapter+fake shape: absent credentials mean a
deterministic fake stands in, and the feature it's part of still works end to end. See
[The Adapter+Fake Pattern](/docs/building-features/the-adapter-fake-pattern) for the mechanism
behind this.

## Bot check: Cloudflare Turnstile

`TURNSTILE_SITE_KEY` and `TURNSTILE_SECRET_KEY`. Off by default, meaning a no-op that always
passes; once both are set, the Turnstile widget renders on the sign-in form and every submission is
verified against Cloudflare before a code is sent.

## S3-compatible object storage

`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `S3_BUCKET`, `S3_REGION`, and `S3_ENDPOINT` for a
non-AWS provider like Cloudflare R2. Without these, Active Storage falls back to local disk. See
[Production Database and Storage](/docs/deployment/production-database-and-storage).

## `APP_HOST`

Your production hostname. This one isn't a third-party credential, but it belongs in the same
"set it before you rely on production behaving correctly" category: it's what canonical URLs, the
sitemap, and the feeds use to build absolute links, and mailer links read it too.

## Mobile: App Store and Play Store

Shipping the native apps needs an Apple Developer Program membership ($99/year), a Google Play
Console account ($25 one time), signing certificates or a keystore, and, if you're offering
in-app purchases, StoreKit and Play Billing product setup in each store's console. None of this is
needed to develop or even deploy the web app; it's specific to the mobile shells. See
[Mobile Overview](/docs/mobile-apps/mobile-overview).

## The pattern, if you're adding your own key

Every credential in the app resolves from `ENV` first, then Rails encrypted credentials as a
fallback, and every integration built around a credential has a fake that runs without it. If
you're wiring up a new third-party service yourself, follow the same shape; see
[The add-integration Skill](/docs/claude-code/skill-add-integration).

## Next

You've now covered the full credential reference. See how to pull kit updates into your product
without losing your own work: [Pulling Kit Updates](/docs/upgrading-releases/pulling-kit-updates).