.env.example

# ── Supabase (Build-time: bundled into JS) ──────────────────
# These are public keys — safe to include in client-side code.
# Get them from: Supabase Dashboard → Settings → API
VITE_SUPABASE_URL=https://YOUR_PROJECT.supabase.co
VITE_SUPABASE_ANON_KEY=eyJ...

# ── Supabase (Runtime: Netlify Functions only) ──────────────
# Duplicated without VITE_ prefix so Netlify Functions can read them.
SUPABASE_URL=https://YOUR_PROJECT.supabase.co
SUPABASE_ANON_KEY=eyJ...

# Service role key — NEVER expose client-side.
# Used for admin ops: invites, user lookup, pending invite management.
# Get it from: Supabase Dashboard → Settings → API → service_role
SUPABASE_SERVICE_ROLE_KEY=eyJ...

# ── Cookie Encryption ───────────────────────────────────────
# At least 32 characters. Used to derive the AES-256-GCM key
# for encrypting session cookies. Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
COOKIE_SECRET=

# ── Site URL ────────────────────────────────────────────────
# Your production URL (no trailing slash). Used for OAuth redirects
# and email confirmation links.
SITE_URL=https://YOUR_PROJECT.YOUR_DOMAIN.TLD

# ── OCR Receipt Parsing (optional) ──────────────────────────
# OpenRouter API key for vision model access.
# Get one at: https://openrouter.ai/keys
OPENROUTER_API_KEY=