diff --git a/.env.example b/.env.example
index 2616a5f8..17659420 100644
--- a/.env.example
+++ b/.env.example
@@ -37,6 +37,9 @@ NEXT_PUBLIC_STORAGE_DOMAIN=
 NEXT_PUBLIC_ALLOW_CREDENTIALS=
 NEXT_PUBLIC_DISABLE_SIGN_UP=
 
+# API configuration (optional)
+NEXT_API_BODY_SIZE_LIMIT= # e.g. 50mb (defaults to 1mb)
+
 # Integration providers (optional)
 TRELLO_APP_API_KEY=
 TRELLO_APP_SECRET=
diff --git a/README.md b/README.md
index dd278ef6..139f21c9 100644
--- a/README.md
+++ b/README.md
@@ -150,6 +150,7 @@ pnpm dev
 | `SMTP_REJECT_UNAUTHORIZED`                | Reject invalid certificates (defaults to true if not set) | For Email                             | `false`                                                     |
 | `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                             | For Email                             | `true`                                                      |
 | `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                             | Yes                                   | `http://localhost:3000`                                     |
+| `NEXT_API_BODY_SIZE_LIMIT`                | Maximum API request body size (defaults to 1mb)           | No                                    | `50mb`                                                      |
 | `BETTER_AUTH_ALLOWED_DOMAINS`             | Comma-separated list of allowed domains for OIDC logins   | For OIDC/Social login                 | `example.com,subsidiary.com`                                |
 | `BETTER_AUTH_SECRET`                      | Auth encryption secret                                    | Yes                                   | Random 32+ char string                                      |
 | `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                  | No                                    | `http://localhost:3000,http://localhost:3001`               |
diff --git a/apps/web/next.config.js b/apps/web/next.config.js
index 75681531..03003b73 100644
--- a/apps/web/next.config.js
+++ b/apps/web/next.config.js
@@ -95,6 +95,12 @@ const config = {
     swcPlugins: [["@lingui/swc-plugin", {}]],
   },
 
+  api: {
+    bodyParser: {
+      sizeLimit: env("NEXT_API_BODY_SIZE_LIMIT") || '1mb',
+    },
+  },
+
   async rewrites() {
     return [
       {
diff --git a/cloud/docker-compose.yml b/cloud/docker-compose.yml
index 078b30b2..02705d35 100644
--- a/cloud/docker-compose.yml
+++ b/cloud/docker-compose.yml
@@ -56,10 +56,13 @@ services:
       - NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME=${NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME}
       - NEXT_PUBLIC_STORAGE_DOMAIN=${NEXT_PUBLIC_STORAGE_DOMAIN}
 
-      # Auth config
+      # Auth config (optional)
       - NEXT_PUBLIC_ALLOW_CREDENTIALS=${NEXT_PUBLIC_ALLOW_CREDENTIALS}
       - NEXT_PUBLIC_DISABLE_SIGN_UP=${NEXT_PUBLIC_DISABLE_SIGN_UP}
 
+      # API configuration (optional)
+      - NEXT_API_BODY_SIZE_LIMIT=${NEXT_API_BODY_SIZE_LIMIT}
+
       # Integration providers
       - TRELLO_APP_API_KEY=${TRELLO_APP_API_KEY}
       - TRELLO_APP_SECRET=${TRELLO_APP_SECRET}
diff --git a/docker-compose.yml b/docker-compose.yml
index 79caeb99..ec96cf0b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,6 +50,9 @@ services:
       - NEXT_PUBLIC_ALLOW_CREDENTIALS=${NEXT_PUBLIC_ALLOW_CREDENTIALS}
       - NEXT_PUBLIC_DISABLE_SIGN_UP=${NEXT_PUBLIC_DISABLE_SIGN_UP}
 
+      # API configuration (optional)
+      - NEXT_API_BODY_SIZE_LIMIT=${NEXT_API_BODY_SIZE_LIMIT}
+
       # Integration providers (optional)
       - TRELLO_APP_API_KEY=${TRELLO_APP_API_KEY}
       - TRELLO_APP_SECRET=${TRELLO_APP_SECRET}
diff --git a/turbo.json b/turbo.json
index 58361b3f..d495494a 100644
--- a/turbo.json
+++ b/turbo.json
@@ -114,6 +114,7 @@
     "NEXT_PUBLIC_AVATAR_BUCKET_NAME",
     "NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME",
     "NEXT_PUBLIC_ALLOW_CREDENTIALS",
+    "NEXT_API_BODY_SIZE_LIMIT",
     "NEXT_PUBLIC_DISABLE_SIGN_UP",
     "NEXT_PUBLIC_USE_STANDALONE_OUTPUT",
     "S3_REGION",