.env.example

# Supabase (required for auth + scans)
# Get these from supabase.com → your project → Settings → API
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key

# Service role key — server-only. Used by the Stripe webhook to upsert
# subscription rows (bypasses RLS). Do not expose to the browser.
SUPABASE_SERVICE_ROLE_KEY=

# --- Scan engines ---
# Set at least ONE of these. Each one you set lights up that engine as a
# selectable option in the scan UI (see lib/engines/index.ts for the
# registry — that's where you'd wire up a new engine too).
#
# Perplexity — used for AI-answer scans AND returns real citation URLs
# (lib/citationAggregator.ts depends on this).
# Get a key at https://www.perplexity.ai/settings/api
PERPLEXITY_API_KEY=

# OpenAI — powers TWO engines off the same key:
#   - "openai" — plain gpt-4o-mini chat completion (lib/engines/openai.ts)
#   - "chatgpt_search" — gpt-4o-mini + the Responses API web_search tool,
#     i.e. ChatGPT's browse mode. Also returns real citation URLs.
#     (lib/engines/chatgptSearch.ts)
# Get a key at https://platform.openai.com/api-keys
OPENAI_API_KEY=

# Gemini — used with gemini-1.5-flash (see lib/engines/gemini.ts).
# Get a key at https://aistudio.google.com/apikey
GEMINI_API_KEY=

# Claude (Anthropic) — used with claude-haiku-4-5 (see lib/engines/claude.ts).
# Get a key at https://console.anthropic.com/settings/keys
ANTHROPIC_API_KEY=

# --- Stripe billing (optional) ---
# Checkout + quota enforcement degrade gracefully if these are missing —
# the app still runs, it just treats everyone as unlimited/free-tier local dev.
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRICE_STARTER=
STRIPE_PRICE_PRO=

# --- Email digest (optional) ---
# Weekly rank-change digest, sent via app/api/digest/route.ts.
# Get a key at https://resend.com/api-keys
RESEND_API_KEY=
RESEND_FROM_EMAIL=digest@yourdomain.com

# Shared secret to protect the digest cron endpoint — set any random string,
# then pass it as `Authorization: Bearer <value>` when triggering
# /api/digest from Vercel Cron / GitHub Actions / cron-job.org.
CRON_SECRET=

# App URL (for auth + Stripe success/cancel redirects)
NEXT_PUBLIC_APP_URL=http://localhost:3000