.env.example

# Copy to .env and fill in. Everything here is also set on Netlify, per environment.
#
# The site builds and runs with none of these. Supabase driven parts stay quiet rather
# than failing, so a fork or a first clone works before anybody has been given keys.
# See supabase/README.md for where each value comes from.

# Safe to expose. Ships in the browser bundle by design.
PUBLIC_SUPABASE_URL=

# The v2 project ref, for pnpm types. Not defaulted on purpose: the old ref still serves
# the live site and regenerating against it would quietly empty the generated types.
SUPABASE_PROJECT_REF=

PUBLIC_SUPABASE_ANON_KEY=

# Never expose. Bypasses row level security completely. Server only, and it is what
# every write on the site goes through.
SUPABASE_SERVICE_ROLE_KEY=

# Rotatable secret used to hash a visitor's IP into a like dedupe token. Rotating it
# forgets who liked what without ever having stored an address. Any long random string.
LIKE_IP_SECRET=

# Drafts a title, a one line summary and a slug for a submitted dev disaster. Without a
# key the drafter falls back to the story's own opening line and never calls out, which
# works but reads flatter. AI_API_URL and AI_MODEL default to OpenAI chat completions and
# gpt-4o-mini, so only the key is usually needed.
AI_API_KEY=
AI_API_URL=
AI_MODEL=

# Used once, after a data load, if the badge matcher is to key on stable Twitch ids
# rather than on logins. Not needed at build time or at runtime. See docs/backfill.md.
TWITCH_CLIENT_ID=
TWITCH_CLIENT_SECRET=

# PARKED FOR V1. The three below are listed for completeness and must stay unset. v1 sends
# no email of any kind, so there is no sender, no address and no drain on a timer. Setting
# any of them is step one of turning notifications on, which is a decision with a real
# ongoing cost attached, not a configuration gap to be filled in. docs/notifications.md is
# the procedure, including the copy on submit, privacy, terms and account that has to
# change back at the same time. docs/new-project.md deliberately omits all three.
#
# RESEND_API_KEY   Mail provider key. src/lib/mail.ts is written but nothing calls it.
# MAIL_FROM        From address. Would need a domain verified with the provider.
# NOTIFY_SECRET    Bearer token for the drain at /api/notifications/. Unset, that route
#                  404s every request before it touches the database, which is the only
#                  reason it is safe to leave in the route table. The table it would drain
#                  does not exist either: the enqueue trigger and email_outbox are both
#                  held in supabase/deferred/, so nothing queues and there is nothing to
#                  send. Do not read these as "configured off". They are absent.
RESEND_API_KEY=
MAIL_FROM=
NOTIFY_SECRET=