.env.example

# AWS Configuration (only necessary in production)
# Uncomment and set these for production
# AWS_REGION=us-west-2
# AWS_ROLE_ARN=arn:aws:iam::123456789123:role/vercel-app-role

# Ory.sh configuration
ORY_PROJECT_API_KEY=your_ory_access_token
NEXT_PUBLIC_ORY_SDK_URL=https://{unique-subdomain}.projects.oryapis.com
# NEXT_PUBLIC_ORY_UI_URL=

# Ory OAuth2 client for obtaining ID tokens (used for data proxy authentication)
# Create via: ory create oauth2-client --grant-type authorization_code --response-type code --scope openid --redirect-uri http://localhost:3000/api/internal/oauth2/callback --token-endpoint-auth-method client_secret_basic
# ORY_OAUTH2_CLIENT_ID=
# ORY_OAUTH2_CLIENT_SECRET=

# Audience the API requires of bearer tokens; unset, each request's own origin.
# Vercel previews set it to staging's origin so a staging `source-coop login`
# works on every preview URL.
# API_AUDIENCE=https://staging.source.coop

# Storage configuration
NEXT_PUBLIC_S3_ENDPOINT=https://data.source.coop

# Encryption key for the proxy-credentials cookie cache.
# Generate with: openssl rand -base64 32
# PROXY_CREDS_COOKIE_KEY=

# Assets S3 bucket and CloudFront CDN configuration
# The bucket name is typically: sc-{stage}-assets (e.g., sc-prod-assets, sc-dev-assets)
# ASSETS_BUCKET=assets.staging.source.coop
# ASSETS_DOMAIN=assets.staging.source.coop

# DynamoDB configuration (for local development)
DYNAMODB_ENDPOINT=http://localhost:8000
STAGE=local

# Cloudflare Analytics Engine (request analytics written by the data proxy).
# Token needs Account Analytics:Read. Dataset is source_data_proxy_production
# or source_data_proxy_staging. Optional — analytics UI hides itself when unset.
# CF_ANALYTICS_ACCOUNT_ID=
# CF_ANALYTICS_API_TOKEN=
# CF_ANALYTICS_DATASET=source_data_proxy_staging