.env.example

# --- Stellar / Soroban ---
# testnet | mainnet (selects the network passphrase)
STELLAR_NETWORK=testnet
# Stellar secret key (S...) used to sign update_impact_score transactions
ADMIN_SECRET_KEY=
# Soroban contract address for the ProjectRegistry
PROJECT_REGISTRY_CONTRACT_ID=
# Stellar RPC endpoint
RPC_URL=https://soroban-testnet.stellar.org

# --- HTTP server ---
# Port the API listens on
PORT=3001
# Origin allowed by CORS
FRONTEND_URL=http://localhost:3000
# Bearer token for /api/admin/*. If unset, admin auth is skipped (dev only).
ADMIN_API_KEY=
# Token required to open a /ws WebSocket connection (via ?token= or Bearer auth).
# Falls back to ADMIN_API_KEY; if both unset, WebSocket auth is skipped (dev only).
WS_AUTH_TOKEN=

# --- Rate limiting (optional; sensible defaults applied when unset) ---
# Public endpoints: window length and max requests per IP per window
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=100
# Admin endpoints: stricter limits (default window mirrors RATE_LIMIT_WINDOW_MS)
RATE_LIMIT_ADMIN_WINDOW_MS=60000
RATE_LIMIT_ADMIN_MAX=20