.env.local (copy .env.example to start). Variables without a NEXT_PUBLIC_ prefix are server-side only and never reach the browser; NEXT_PUBLIC_ variables are inlined into the client bundle at build time, so only put non-secret values there.
Required
In a Docker build these two are also required at build time — the storefront prerenders pages against the Spree API. See Deployment.

