Self-host OpenInterviewer

Your deployment, credentials, and storage

Standalone mode keeps researcher credentials in your server environment. On Node or Vercel it needs Node 24.19+, either Vercel AI Gateway access or one Google Gemini, Anthropic Claude, OpenAI, or OpenRouter key, an Upstash Redis REST URL and token, and four independent secrets.

On Cloudflare it runs as one Worker with a Durable Object for storage and a Queue for background analysis. It needs an admin password of 16 to 1,009 ASCII characters (sign-in requests are limited to 1 KiB, so multi-byte characters lower the maximum), one provider key and no Redis; the installer generates the other secrets and the recovery epoch.

Agent-friendly setup

git clone https://github.com/linxule/openinterviewer.git
cd openinterviewer
npm ci
cp .env.example .env.local
# Fill the required standalone values in .env.local, then:
npm run setup:check -- --mode standalone
npm run dev

The setup checker reports missing variable names and invalid shapes only. It does not print values, write secrets, provision resources, or contact an AI provider.

Cloudflare installer

npm ci
npm run build:cloudflare
npm run check:cloudflare -- --skip-build
npm run setup:cloudflare -- plan --install <name> --env production --provider <provider> --jurisdiction eu
# Review the plan, then pipe the admin password and provider key from your secret
# manager, or omit --secrets-stdin for a hidden prompt. Keep the template (op://
# references only) outside the checkout: an untracked file there blocks apply.
op inject -i ~/secure/secrets.tpl.json | npm run setup:cloudflare -- apply --install <name> \
  --env production --provider <provider> --jurisdiction eu --secrets-stdin --yes \
  --operator-token-file <path outside the repository>
npm run setup:cloudflare -- verify --install <name> --env production

The plan is read-only. Apply creates only the named Worker (with its Durable Object), Queue and dead-letter queue, sends secrets through stdin, and records a non-secret receipt. Choose the storage jurisdiction before the first install; changing it later is a migration. Workers Paid is recommended: the Free plan allows 10 ms of CPU time per request.

Security essentials

Keep all credentials server-only. Never reuse the admin password, session secret, participant secret, rate-limit salt, or operator token. Use a write-capable Redis token only on the server.

Full runbook

The repository documents local setup, Vercel environment scoping, the Cloudflare installer and operator runbook, readiness checks, hosted BYOS, legacy-link retirement, staging, and rollback.

Open the setup guide