VITE_SUPABASE_ANON_KEY="<Test Anon Key>"
VITE_SUPABASE_URL='http://127.0.0.1:54321'
SUPABASE_SERVICE_ROLE_KEY="<Test Service Role Key>"
# Optional: SSO-only mode. Set to any Supabase OAuth provider slug — e.g.
# 'custom:my-idp' for a custom OIDC provider configured in your Supabase
# dashboard — and the app root becomes the only auth surface: its signed-out
# UI is unchanged, but the sign-in/sign-up affordances redirect to the
# provider, /signin & /signup & /signup-email bounce to root, and
# unauthenticated deep links redirect straight to the provider. Leave unset
# to keep the native auth UI (the local Supabase CLI stack can't host
# custom OIDC providers).
# VITE_SSO_PROVIDER="custom:my-idp"
# Optional: when SSO owns the identity, point profile / password / delete
# management at the provider's account page (the accounts.google.com model)
# instead of editing them in-app. Unset keeps the native in-app controls.
# VITE_ACCOUNT_URL="https://accounts.example.com/account"
VITE_POSTHOG_PROJECT_KEY="<Test PostHog Project Key>"
VITE_SENTRY_ENVIRONMENT="local"
VITE_SENTRY_DSN="<Sentry DSN>"
ANTHROPIC_API_KEY="<Test Anthropic API Key>"
OPENROUTER_API_KEY="<Test OpenRouter API Key>"
OPENAI_API_KEY="<Test OpenAI API Key>"
GOOGLE_API_KEY="<Test Google API Key>"
FAL_KEY="<Test FAL API Key>"
BILLING_SERVICE_URL="<Test Billing Service URL>"
BILLING_SERVICE_KEY="<Test Billing Service Key>"
ENVIRONMENT="local"
ADAM_URL="<Adam URL or dev URL>"
WEBHOOK_BASE_URL="<Public TanStack App URL>"
NGROK_URL="<NGROK URL>"
# Shared bearer secret for the internal server-to-server account-purge endpoint
# (POST /api/internal/account/delete). The upstream identity provider's purge
# worker presents this to erase a user's data here when their account is
# deleted. Leave unset to hard-disable the endpoint (it 503s every request).
# Provider-agnostic: any deployment sets its own value.
ACCOUNT_PURGE_SECRET="<Shared account-purge secret>"