[adelrodriguez]

The API declared an ARCJET_KEY environment variable, but no code reads it, so every scaffolded project carried a credential for an account it never uses. This removes it from the API's .env.schema, its development defaults, and Turbo's build env list.

The @arcjet/ip dependency stays: rate limiting uses its findIp to resolve the client IP, and that needs no key or Arcjet account.

Evidence

• Before: grep -rn ARCJET found ARCJET_KEY in apps/api/.env.schema, apps/api/.env.development, and turbo.json. After: no matches outside node_modules.
• bun run codegen, bun run check, and bun template doctor (boundaries, analyze, env:check, build) all pass.

Merge danger

• Door: two-way.
• Blast radius: small. Only apps/api env config changes, and no code reads the variable.

Changes made by Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v1	Ready	Preview	Oct 16, 2026 1:40pm UTC
v1-docs	Ready	Preview	Oct 16, 2026 1:40pm UTC

[pullfrog]

✅ No new issues found.

Reviewed changes

This review covers removal of the unused Arcjet credential from API environment configuration and the Turbo build environment.

• API environment: Removes ARCJET_KEY from the development defaults and .env.schema.
• Build configuration: Removes ARCJET_KEY from Turbo's build task environment list; API IP-based rate limiting continues to use @arcjet/ip without this credential.

  ^{｜ View workflow run ｜ Using gpt-6-luna ｜ 𝕏}