Configuration

Music API environment

Variable	Default	Used for
`PORT`	`4175`	TCP port; server listens on `0.0.0.0`
`NGAMIA_API_BASE_URL`	`http://localhost:8080`	Ngamia API origin; trailing slash is removed
`CAMEL_ACCOUNTS_URL`	`https://accounts.camelcreatives.com`	Server-side OAuth token endpoint base
`CAMEL_ACCOUNTS_CLIENT_ID`	`ngamia_web`	Token exchange client ID
`CAMEL_ACCOUNTS_REDIRECT_URI`	`http://localhost:4174/auth/callback`	Exact redirect URI sent to Camel token endpoint
`ALLOWED_ORIGINS`	`https://app.ngamia.com,http://localhost:4174`	Comma-separated exact browser origins
`NODE_ENV`	Runtime value	Enables `Secure` cookies only when `production`

The service loads .env.local first and then .env through dotenv. MUSIC_STORAGE_DIR is not part of this NestJS service’s .env.example; the Ngamia API owns audio storage configuration.

Web application variables

Variable	Default / example	Used for
`NEXT_PUBLIC_API_URL`	Local `http://localhost:4175`, production `https://api.ngamia.com`	Browser-facing Music API origin
`NEXT_PUBLIC_CAMEL_ACCOUNTS_URL`	`https://accounts.camelcreatives.com`	OAuth authorization page
`NEXT_PUBLIC_CAMEL_ACCOUNTS_CLIENT_ID`	`ngamia_web`	OAuth authorize request
`NEXT_PUBLIC_CAMEL_ACCOUNTS_REDIRECT_URI`	`${window.location.origin}/auth/callback`	Registered callback URI

The same OAuth client ID and redirect URI must be used in the web authorization request and the backend code exchange. Do not prefix server-only settings with NEXT_PUBLIC_; public-prefixed values are embedded into browser code.

Production checklist

Set NGAMIA_API_BASE_URL to the reachable Ngamia API origin, without an API path suffix.
Set the production Camel Accounts URL, client ID, and exact callback URL (https://app.ngamia.com/auth/callback).
Set ALLOWED_ORIGINS=https://app.ngamia.com (add other exact trusted origins only when required).
Set the web app’s NEXT_PUBLIC_API_URL=https://api.ngamia.com and matching OAuth values.
Serve the API over HTTPS so cookies are marked Secure.
Verify web/API cookie behavior in supported browsers and confirm the Ngamia API is reachable from the deployment runtime.

The API parses JSON and URL-encoded request bodies up to 2 MB. Generation prompts have a stricter route-level limit of 4,100 characters.

See origins and cookies and deployment.