DEN_API_PUBLIC_URL must use HTTPS outside development and lo

Error message

DEN_API_PUBLIC_URL must use HTTPS outside development and localhost.

What it means

This error enforces TLS in production: if DEN_API_PUBLIC_URL uses http:// and the environment neither sets options.allowInsecureHttp nor has a localhost-style hostname (isLocalPublicApiHost), the public base URL is rejected. It prevents serving public API links over plaintext outside development.

Source

Thrown at ee/apps/den-api/src/request-url.ts:107

): string | undefined {
  const configured = value?.trim()
  if (!configured) return undefined

  let url: URL
  try {
    url = new URL(configured)
  } catch {
    throw new Error("DEN_API_PUBLIC_URL must be an absolute http or https URL.")
  }

  if (url.protocol !== "http:" && url.protocol !== "https:") {
    throw new Error("DEN_API_PUBLIC_URL must be an absolute http or https URL.")
  }
  if (url.username || url.password || url.search || url.hash) {
    throw new Error("DEN_API_PUBLIC_URL cannot contain credentials, a query string, or a fragment.")
  }
  if (url.protocol !== "https:" && !options.allowInsecureHttp && !isLocalPublicApiHost(url.hostname)) {
    throw new Error("DEN_API_PUBLIC_URL must use HTTPS outside development and localhost.")
  }

  const pathname = url.pathname.replace(/\/+$/, "")
  return `${url.origin}${pathname === "/" ? "" : pathname}`
}

View on GitHub (pinned to 2b7df46e8a)

Solutions

Set DEN_API_PUBLIC_URL to https://api.example.com (terminate TLS at your proxy/load balancer).
If this is genuinely a dev environment, enable the allowInsecureHttp option (or the corresponding dev env flag) for this deployment.
Use a localhost hostname (localhost, 127.0.0.1) if the URL really is local-only and exempt from the HTTPS rule.
Audit the deploy config so production always inherits an https:// public URL.

Example fix

// before
DEN_API_PUBLIC_URL=http://api.example.com
// after
DEN_API_PUBLIC_URL=https://api.example.com

Defensive patterns

Strategy: validation

Validate before calling

const u = new URL(process.env.DEN_API_PUBLIC_URL ?? "")
if (u.protocol === "http:" && !isLocalPublicApiHost(u.hostname)) {
  throw new Error("DEN_API_PUBLIC_URL must use HTTPS outside development and localhost")
}

Type guard

function isProductionSafePublicUrl(value: string | undefined): value is string {
  try {
    const u = new URL(value ?? "")
    return u.protocol === "https:" || (u.protocol === "http:" && isLocalPublicApiHost(u.hostname))
  } catch { return false }
}

Try / catch

try {
  const baseUrl = apiPublicUrl(env)
} catch (e) {
  if (e.message.includes("must use HTTPS")) {
    console.error("Configure a TLS endpoint (e.g. via your ingress/proxy) and set DEN_API_PUBLIC_URL to https://...")
    process.exit(1)
  }
  throw e
}

Prevention

Terminate TLS at your proxy/load balancer and expose the https origin as DEN_API_PUBLIC_URL
Only use http:// with localhost hostnames in dev, where the insecure-HTTP exemption applies
Set NODE_ENV/deployment flags consistently so allowInsecureHttp never reaches production
Run an env lint in CI that fails when production config contains an http:// public URL

When it happens

Trigger: apiPublicUrl -> normalizeConfiguredPublicApiBaseUrl with DEN_API_PUBLIC_URL=http://api.example.com on a production deployment where allowInsecureHttp is false and the hostname is not localhost/127.0.0.1/etc.

Common situations: Deploying behind a TLS-terminating proxy but configuring the internal http:// origin as the public URL; forgetting to switch from a local http URL when promoting staging config to production; misclassifying a public hostname as local.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/4547635c8e2f423b. Report an issue: GitHub.