.env.example

# ============================================================
# REQUIRED — Vite client vars (safe for client, prefix with VITE_)
# ============================================================
VITE_SUPABASE_URL=https://your-project.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-key
VITE_PRODUCTION_MODE=true

# ============================================================
# REQUIRED — Server-only (for API at /api/admin)
# Set these in Vercel dashboard → Environment Variables
# For local dev: also add to .env (file is gitignored)
# ============================================================
# Supabase service_role key (Project Settings → API → service_role secret)
SUPABASE_SERVICE_KEY=your-service-role-key-here

# Admin login credentials
ADMIN_USERNAME=admin@example.com
ADMIN_PASSWORD=your-admin-password

# JWT signing secret — set a fixed value so tokens survive cold starts
SUPABASE_JWT_SECRET=a-random-64-char-hex-secret

# Master key bypasses normal login (optional, for emergencies)
MASTER_KEY=your-master-key-here

# ECDSA P-256 private key for ES256 JWT signing (optional, falls back to HS256)
# Generate: openssl ecparam -genkey -name prime256v1 -noout -out ec-private.pem
# Note: multi-line PEM must be quoted
JWT_EC_PRIVATE_KEY="-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----"