Settings
Credentials (presence only — values never shown)
| Variable | Purpose | Status |
|---|---|---|
SEMRUSH_API_KEY | SEMrush API key (extract) | missing |
BING_API_KEY | Bing Webmaster API key (extract) | missing |
GSC_CLIENT_ID | GSC OAuth client id (data access) | set |
GSC_CLIENT_SECRET | GSC OAuth client secret (data access) | set |
GSC_REFRESH_TOKEN | GSC refresh token (CLI fallback; panel uses per-client tokens) | set |
GMAIL_ACCOUNT | Gmail account for scheduled-export ingest (optional) | missing |
FERNET_KEY | Fernet key (encrypts per-client GSC tokens) | set |
PANEL_CLIENT_ID | Panel login OAuth client id (Google, Web app) | missing |
PANEL_CLIENT_SECRET | Panel login OAuth client secret | missing |
ALLOWED_DOMAIN | Google Workspace domain allowed to log in | missing |
SECRET_KEY | Panel session secret | set |
Panel base URL: seo-tracker.tailfc2f92.ts.net · Login: disabled (local dev)
Two separate Google OAuth clients
- Panel login (
PANEL_CLIENT_ID/SECRET): a Web application OAuth client. Redirect URI:seo-tracker.tailfc2f92.ts.net/auth/callback. - GSC data access (
GSC_CLIENT_ID/SECRET): a Desktop app OAuth client. Used by the per-client "Connect Search Console" flow; redirect URI:seo-tracker.tailfc2f92.ts.net/gsc/callback(register it on the Desktop client too — Google accepts it).
Hosting notes
- Run behind Tailscale funnel for a public HTTPS URL with no firewall/DNS work; the Google login above is then your access control.
- Secrets live in
.env(never committed) and per-client GSC tokens are Fernet-encrypted in the panel DB.