.env.local.example

# ============================================================
# REQUIRED — the app won't start without these.
# ============================================================

# Supabase (Project Settings → API)
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key

# Supabase service-role key. Bypasses RLS; used only by server-side
# routes (the webhook and automation engine). Keep this secret —
# never paste it into client code.
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# WhatsApp token encryption (64 hex chars = 32 bytes, AES-256-GCM).
# Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Rotating this value orphans every token encrypted under the previous
# key — users have to re-save their WhatsApp settings to reconnect.
ENCRYPTION_KEY=your-64-char-hex-key-here

# Meta App Secret (Meta for Developers → App Settings → Basic).
# Verifies the HMAC-SHA256 signature on every inbound webhook POST.
# Required — without it the webhook rejects every request.
META_APP_SECRET=your-meta-app-secret

# ============================================================
# RECOMMENDED — safe defaults exist but you'll want to set these.
# ============================================================

# Canonical public URL of this deployment (scheme + host, no trailing
# slash). Used for the sitemap, OG images, and any email the app
# sends. Defaults to https://wacrm.tech if unset.
NEXT_PUBLIC_SITE_URL=https://crm.example.com

# ============================================================
# OPTIONAL — only needed if you use the feature.
# ============================================================

# Shared secret protecting GET /api/automations/cron. Required if you
# use Wait steps in automations (a scheduled pinger drains pending
# executions). Generate any long random string:
#   openssl rand -hex 32
# See docs/automations-and-cron.md.
# AUTOMATION_CRON_SECRET=generate-a-long-random-string