diff --git a/app/src/App.tsx b/app/src/App.tsx
index c793e0c..9ee3e62 100644
--- a/app/src/App.tsx
+++ b/app/src/App.tsx
@@ -6,7 +6,7 @@ import { RepositoriesList } from "./RepositoriesList";
 
 const queryClient = new QueryClient();
 
-const hostame = import.meta.env.VITE_HOSTNAME ?? window.location.hostname;
+const hostame = import.meta.env.KNOT_HOSTNAME;
 
 const App: Component = () => {
   return (
diff --git a/app/src/SigninButton.tsx b/app/src/SigninButton.tsx
index 00ce159..27d9cc0 100644
--- a/app/src/SigninButton.tsx
+++ b/app/src/SigninButton.tsx
@@ -6,10 +6,10 @@ import { createSignal, Show } from "solid-js";
 import { createForm } from "@tanstack/solid-form";
 import { Dialog } from "./components/Dialog";
 import { Button } from "./components/Button";
-import { OAUTH_CLIENT_METADATA } from "./oauth_metadata";
 import { FormError } from "./components/FormError";
 import { HandleChip } from "./components/HandleChip";
 import { useSession } from "./session";
+import { OAUTH_SCOPE } from "./lib/oauth_metadata";
 
 type UseOAuthScopeFlowOptions = {
   onError?: (error: unknown) => void;
@@ -20,7 +20,7 @@ export const useOAuthScopeFlow = (options: UseOAuthScopeFlowOptions = {}) => {
   const connect = async (identifier: ActorIdentifier) => {
     try {
       const authUrl = await createAuthorizationUrl({
-        scope: OAUTH_CLIENT_METADATA.scope,
+        scope: OAUTH_SCOPE,
         target: {
           type: "account",
           identifier,
diff --git a/app/src/lib/oauth_metadata.ts b/app/src/lib/oauth_metadata.ts
new file mode 100644
index 0000000..0363e2a
--- /dev/null
+++ b/app/src/lib/oauth_metadata.ts
@@ -0,0 +1,30 @@
+import { Did } from "@atcute/lexicons";
+
+export function buildOAuthClientMetadata(hostname: string, isDev: boolean) {
+  const scope = `atproto repo:sh.tangled.repo`;
+
+  const client_id = isDev
+    ? `http://localhost?redirect_uri=${encodeURIComponent(hostname)}&scope=${encodeURIComponent(scope)}`
+    : `https://${hostname}/oauth-client-metadata.json`;
+  const client_uri = isDev ? "http://localhost:5137" : `https://${hostname}`;
+  return {
+    client_id,
+    client_uri: client_uri,
+    redirect_uris: [client_uri],
+    scope,
+    application_type: "web",
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code"],
+    dpop_bound_access_tokens: true,
+  };
+}
+
+const OAUTH_CLIENT_METADATA = buildOAuthClientMetadata(
+  import.meta.env?.KNOT_HOSTNAME,
+  import.meta.env?.DEV ?? false,
+);
+
+export const OAUTH_SCOPE = OAUTH_CLIENT_METADATA.scope;
+export const OAUTH_CLIENT_ID = OAUTH_CLIENT_METADATA.client_id;
+export const OAUTH_CLIENT_URI = OAUTH_CLIENT_METADATA.client_uri;
+export const OAUTH_REDIRECT_URI = OAUTH_CLIENT_METADATA.redirect_uris[0];
diff --git a/app/src/oauth_metadata.ts b/app/src/oauth_metadata.ts
deleted file mode 100644
index 886712b..0000000
--- a/app/src/oauth_metadata.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-export const OAUTH_SCOPE = "atproto repo:sh.tangled.repo";
-
-export function buildOAuthClientMetadata(baseUrl: URL, isDev: boolean) {
-  const client_id = isDev
-    ? `http://localhost?redirect_uri=${encodeURIComponent(baseUrl.toString())}&scope=${encodeURIComponent(OAUTH_SCOPE)}`
-    : `${baseUrl.toString()}/oauth-client-metadata.json`;
-  return {
-    client_id,
-    client_uri: baseUrl.toString(),
-    redirect_uris: [baseUrl.toString()],
-    scope: OAUTH_SCOPE,
-    application_type: "web",
-    token_endpoint_auth_method: "none",
-    grant_types: ["authorization_code"],
-    dpop_bound_access_tokens: true,
-  };
-}
-
-export const OAUTH_CLIENT_METADATA = buildOAuthClientMetadata(
-  import.meta.env?.VITE_HOSTNAME ?? "http://127.0.0.1:5173",
-  import.meta.env?.DEV ?? false,
-);
diff --git a/app/src/session.tsx b/app/src/session.tsx
index 7ef8176..101d15c 100644
--- a/app/src/session.tsx
+++ b/app/src/session.tsx
@@ -13,12 +13,12 @@ import {
   listStoredSessions,
   OAuthUserAgent,
 } from "@atcute/oauth-browser-client";
-import { OAUTH_CLIENT_METADATA } from "./oauth_metadata";
+import { OAUTH_CLIENT_ID, OAUTH_REDIRECT_URI } from "./lib/oauth_metadata";
 
 configureOAuth({
   metadata: {
-    client_id: OAUTH_CLIENT_METADATA.client_id,
-    redirect_uri: OAUTH_CLIENT_METADATA.redirect_uris[0],
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
   },
   identityResolver: new LocalActorResolver({
     handleResolver: new XrpcHandleResolver({
diff --git a/app/vite.config.ts b/app/vite.config.ts
index 474b7ec..525e1d1 100644
--- a/app/vite.config.ts
+++ b/app/vite.config.ts
@@ -3,14 +3,14 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { defineConfig, type Plugin } from "vite";
 import solidPlugin from "vite-plugin-solid";
 import devtools from "solid-devtools/vite";
-import { buildOAuthClientMetadata } from "./src/oauth_metadata.ts";
+import { buildOAuthClientMetadata } from "./src/lib/oauth_metadata.ts";
 
 function oauthMetadataPlugin(): Plugin {
   return {
     name: "oauth-metadata",
     configResolved(config) {
       const metadata = buildOAuthClientMetadata(
-        config.env.VITE_HOSTNAME || "http://127.0.0.1:5173",
+        config.env.KNOT_HOSTNAME,
         config.command === "serve",
       );
 
@@ -25,6 +25,7 @@ function oauthMetadataPlugin(): Plugin {
 
 export default defineConfig({
   plugins: [devtools(), solidPlugin(), tailwindcss(), oauthMetadataPlugin()],
+  envPrefix: ["VITE_", "KNOT_"],
   server: {
     // for OAuth, "localhost" hostname is not allowed (RFC 8252)
     host: "127.0.0.1",