.env.example

# ============================================================
# SUPABASE
# Get these from: https://supabase.com/dashboard
# → Project Settings → API
# ============================================================
NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-supabase-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# ============================================================
# AI | Groq
# Used by /api/generate
# Model: llama-3.3-70b-versatile (free tier available)
# Get your key at: https://console.groq.com/keys
# ============================================================
GROQ_API_KEY=your-groq-api-key

# ============================================================
# UPSTASH REDIS (Rate Limiting)
# Get these from: https://console.upstash.com
# → Create a Redis database → REST API
# ============================================================
UPSTASH_REDIS_REST_URL=https://your-region.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-upstash-rest-token

# ============================================================
# CRON / Background Jobs
# Used by /api/keep-alive to authenticate cron requests
# Generate a random secret: openssl rand -hex 32
# ============================================================
CRON_SECRET=your-cron-secret

# ============================================================
# GOOGLE OAUTH (via Supabase)
#
# You do NOT add Google client credentials here directly.
# Supabase handles the OAuth flow. Setup steps:
#
# 1. Go to https://console.cloud.google.com
#    → APIs & Services → Credentials → Create OAuth 2.0 Client ID
#    → Application type: Web application
#    → Authorized redirect URIs:
#       https://your-project-ref.supabase.co/auth/v1/callback
#
# 2. Go to https://supabase.com/dashboard
#    → Authentication → Providers → Google
#    → Paste your Google Client ID and Client Secret
#    → Enable the provider
#
# 3. In Supabase → Authentication → URL Configuration:
#    → Site URL: http://localhost:3000 (dev) or your production URL
#    → Redirect URLs: add http://localhost:3000/auth/callback
#                     and https://yourdomain.com/auth/callback
#
# No extra env vars needed, Supabase stores the Google credentials.
# ============================================================

# ============================================================
# PRODUCTION CHECKLIST
# Required for full production readiness:
#   - All SUPABASE vars (including SERVICE_ROLE_KEY for account deletion)
#   - GROQ_API_KEY
#   - UPSTASH_REDIS_REST_URL + TOKEN (distributed rate limiting)
#   - NEXT_PUBLIC_APP_URL (your deployed domain)
#   - CRON_SECRET (if using /api/keep-alive cron)
# Verify with: curl https://yourdomain.com/api/health
# ============================================================
NEXT_PUBLIC_APP_URL=http://localhost:3000