.env.example

# ==============================================================================
# CROVE POST / POSTIZ - COMPLETE CONFIGURATION REFERENCE (.env.example)
# Documentation: https://docs.postiz.com / https://docs.crove.com
# ==============================================================================

# ==============================================================================
# 1. Required Core Settings (Database, Redis, Security)
# ==============================================================================
# PostgreSQL Connection URL (PgBouncer pooler mode or direct)
DATABASE_URL="postgresql://postiz-user:postiz-password@localhost:5432/postiz-db-local?schema=public&sslmode=prefer"
# Direct PostgreSQL Connection URL (Used for Prisma migrations and direct connections)
DATABASE_DIRECT_URL="postgresql://postiz-user:postiz-password@localhost:5432/postiz-db-local?schema=public&sslmode=prefer"
# Node TLS verification — NEVER set to 0 in production. If you use self-signed
# certificates or a Supabase pooler that requires it, restrict it to dev only.
# NODE_TLS_REJECT_UNAUTHORIZED="0"
# Redis Cache & Session Store URL
REDIS_URL="redis://localhost:6379"
# Cryptographic secret for signing JWT sessions (must be 32+ random characters)
JWT_SECRET="replace-with-a-random-secure-string-min-32-chars"
# Crove internal JWT signing secret
CROVE_POSTIZ_JWT_SECRET="replace-with-a-crove-specific-jwt-secret"

# ==============================================================================
# 2. Application URLs & Routing
# ==============================================================================
# Public URL of the frontend application
FRONTEND_URL="http://localhost:4200"
# Main website URL (for navigation links and landing pages)
MAIN_URL="http://localhost:4200"
# Public URL of the backend API (accessible by browser clients)
NEXT_PUBLIC_BACKEND_URL="http://localhost:3000"
# Internal URL of the backend API (for server-to-server calls within Docker network)
BACKEND_INTERNAL_URL="http://localhost:3000"
# Public URL for MCP (Model Context Protocol) tool endpoints
MCP_URL="http://localhost:3000/api"
# Backend HTTP server listening port (default: 3000)
PORT="3000"
# Multi-tenant / general platform mode flag (required: true)
IS_GENERAL="true"
# Disable public self-registration (true: invite/SSO only, false: open registration)
DISABLE_REGISTRATION="false"
# Disallow email addresses with plus signs (e.g. user+test@example.com)
DISALLOW_PLUS="true"
# Run internal cron jobs for post scheduling and analytics synchronization
RUN_CRON="true"
# Run only MCP server without Web API (optional, default: false)
MCP_ONLY="false"
# Disable Secure flag on cookies for non-HTTPS local development (optional)
NOT_SECURED="false"
# Custom mobile application URL scheme for auth callbacks.
# LEAVE EMPTY unless this deployment ships its own mobile app. The backend
# redirects a live OAuth authorization code to this scheme, so any value here
# hands that code to whichever app registered it on the device. When empty,
# GET /oauth-mobile-callback refuses with 501 instead of redirecting, and the
# frontend omits the mobile deep link entirely.
MOBILE_APP_SCHEME=""
# Hourly rate limit for public API requests per organization
API_LIMIT="100"

# ==============================================================================
# 3. Temporal Orchestration (Background Workflows & Post Scheduling)
# ==============================================================================
# Temporal server gRPC address
TEMPORAL_ADDRESS="localhost:7233"
# Temporal namespace (default: default)
TEMPORAL_NAMESPACE="default"
# Enable TLS for Temporal connection (true/false)
TEMPORAL_TLS="false"
# Temporal Cloud API key (optional, for Temporal Cloud)
TEMPORAL_API_KEY="temporal-cloud-api-key-sample"
# Task queues to exclude from worker polling (comma-separated, optional)
EXCLUDE_QUEUE=""
# Concurrency divider for worker task allocation (default: 1)
WORKER_CONCURRENCY_DIVIDER="1"

## Remember to set your public internet IP address in the allow-list for the API token.
##
## Cloudflare is currently required to save things like social media avatars for accounts.
CLOUDFLARE_ACCOUNT_ID="your-account-id"
CLOUDFLARE_ACCESS_KEY="your-access-key"
CLOUDFLARE_SECRET_ACCESS_KEY="your-secret-access-key"
CLOUDFLARE_BUCKETNAME="your-bucket-name"
CLOUDFLARE_BUCKET_URL="https://your-bucket-url.r2.cloudflarestorage.com/"
CLOUDFLARE_REGION="auto"
## Optional media normalization (postiz-uploader on RunPod Serverless). Requires STORAGE_PROVIDER="cloudflare".
## When set, web uploads are transcoded to 1080p h264 mp4 / downsized images in the background;
## the media record reports status "processing" until the normalized file replaces the original.
#RUNPOD_API_KEY=""
#RUNPOD_ENDPOINT_ID=""
## Optional video clipping (YouTube video -> captioned vertical clips -> draft posts). Requires STORAGE_PROVIDER="cloudflare",
## RUNPOD_API_KEY (with access to both endpoints below) and OPENAI_API_KEY. Ingest jobs go to the CPU endpoint, clip jobs to the
## GPU endpoint of postiz-uploader (which needs its own Oxylabs account to fetch from YouTube); Deepgram transcribes videos
## that have no usable captions.
#RUNPOD_INGEST_ENDPOINT_ID=""
#RUNPOD_CLIPPER_ENDPOINT_ID=""
#DEEPGRAM_API_KEY=""

# ==============================================================================
# 4. Storage Providers (Cloudflare R2 or Local Disk)
# ==============================================================================
# Storage provider type: "cloudflare" (recommended) or "local"
STORAGE_PROVIDER="local"
# Cloudflare Account ID for R2 Object Storage
CLOUDFLARE_ACCOUNT_ID="your-cloudflare-account-id-sample"
# Cloudflare R2 Access Key ID
CLOUDFLARE_ACCESS_KEY="your-cloudflare-r2-access-key-sample"
# Cloudflare R2 Secret Access Key
CLOUDFLARE_SECRET_ACCESS_KEY="your-cloudflare-r2-secret-access-key-sample"
# Cloudflare R2 Bucket Name
CLOUDFLARE_BUCKETNAME="crove-media"
# Cloudflare R2 Public CDN / Custom Domain URL
CLOUDFLARE_BUCKET_URL="https://media.example.com"
# Cloudflare R2 Region (default: auto)
CLOUDFLARE_REGION="auto"
# Local filesystem upload directory path (when STORAGE_PROVIDER="local")
UPLOAD_DIRECTORY="/uploads"
# Public URL path prefix for uploaded files
NEXT_PUBLIC_UPLOAD_DIRECTORY="/uploads"
# Public static asset directory path
NEXT_PUBLIC_UPLOAD_STATIC_DIRECTORY="/uploads"
# Restrict upload domain validation (optional)
RESTRICT_UPLOAD_DOMAINS=""
# Disable client-side image compression before upload (true/false)
DISABLE_IMAGE_COMPRESSION="false"

# ==============================================================================
# 5. Email Delivery & Transactional Notification (Nodemailer SMTP / Resend)
# ==============================================================================
# Email provider: "nodemailer" or "resend"
EMAIL_PROVIDER="nodemailer"
# Default sender email address
EMAIL_FROM_ADDRESS="support@example.com"
# Default sender display name
EMAIL_FROM_NAME="Crove Post"
# SMTP server hostname (e.g. Amazon SES, SendGrid, Mailgun, Postmark)
EMAIL_HOST="email-smtp.ap-southeast-1.amazonaws.com"
# SMTP server port (587 for TLS, 465 for SSL)
EMAIL_PORT="587"
# Require TLS connection for SMTP (true/false)
EMAIL_SECURE="false"
# SMTP authentication username
EMAIL_USER="AKIAEXAMPLEUSER12345"
# SMTP authentication password
EMAIL_PASS="SAMPLE_SMTP_PASSWORD_SECRET"
# Resend API Key (used when EMAIL_PROVIDER="resend")
RESEND_API_KEY="re_sample_resend_api_key_123456"

# ==============================================================================
# 6. Newsletter Providers (Beehiiv / Listmonk)
# ==============================================================================
# Beehiiv API key for newsletter subscription sync
BEEHIIVE_API_KEY="beehiiv_api_key_sample"
# Beehiiv publication ID
BEEHIIVE_PUBLICATION_ID="pub_sample_publication_id"
# Listmonk instance domain URL
LISTMONK_DOMAIN="https://newsletter.example.com"
# Listmonk API username
LISTMONK_USER="api_user"
# Listmonk API key
LISTMONK_API_KEY="listmonk_api_key_sample"
# Listmonk default list ID
LISTMONK_LIST_ID="1"
# Listmonk welcome email template ID
LISTMONK_WELCOME_TEMPLATE_ID="1"

# ==============================================================================
# 7. Brand Customization & White-labeling Engine
# ==============================================================================
# Full application brand name
BRAND_NAME="Crove Post"
# Short application brand name
BRAND_SHORT_NAME="Crove"
# Machine identifier for the MCP server in generated client config
# (`claude mcp add <name>`, `{ mcpServers: { <name>: … } }`, Cursor deep links).
# Must be a lowercase hyphenated slug. Leave EMPTY to derive it automatically
# from BRAND_SHORT_NAME ("Crove" -> "crove", "Crove (Beta)" -> "crove-beta").
BRAND_MCP_CONNECTOR_NAME=""
# Brand meta description
BRAND_DESCRIPTION="The AI-powered multi-channel social media management platform"
# Company legal entity name
BRAND_COMPANY_NAME="Crove Corporation"
# Light mode logo image URL
BRAND_LOGO_URL="https://example.com/logo.svg"
# Dark mode logo image URL
BRAND_LOGO_DARK_URL="https://example.com/logo-dark.svg"
# App icon URL
BRAND_ICON_URL="https://example.com/icon.png"
# Favicon URL
BRAND_FAVICON_URL="/favicon.ico"
# Transactional email logo URL
BRAND_EMAIL_LOGO_URL="https://example.com/email-logo.png"
# Primary brand theme hex color
BRAND_PRIMARY_COLOR="#7c3aed"
# Main landing page website URL
BRAND_WEBSITE_URL="https://example.com"
# Default email domain for support fallbacks
BRAND_DEFAULT_EMAIL_DOMAIN="example.com"
# Community support / Discord invite URL
BRAND_SUPPORT_URL="https://discord.gg/example"
# Documentation site URL
BRAND_DOCS_URL="https://docs.example.com"
# Source repository URL (AGPL-3.0 requirement)
BRAND_SOURCE_URL="https://github.com/DOS/Crove-Post"
# Terms of Service URL
BRAND_TERMS_URL="/terms"
# Privacy Policy URL
BRAND_PRIVACY_URL="/privacy"
# Dedicated support email address
BRAND_SUPPORT_EMAIL="support@example.com"
# Chrome Web Store extension URL
BRAND_EXTENSION_STORE_URL="https://chromewebstore.google.com/detail/sample-extension-id"
# User guide / video tutorial URL
BRAND_TUTORIAL_URL="https://example.com/tutorials"
# Affiliate program URL
BRAND_AFFILIATE_URL="https://example.com/affiliates"
# Claude connector directory listing URL. Leave EMPTY to hide the
# "Add to Claude" button — it defaults to empty on purpose so a deployment
# that forgets to set it cannot offer the upstream listing by accident.
BRAND_CLAUDE_DIRECTORY_URL=""
# Only needed if you run your own Postiz Canva app: its origin from the Canva
# Developer Portal (Security -> Credentials), allowed by CORS on the backend.
#CANVA_APP_ORIGIN="https://app-xxxxxxxxxxx.canva-apps.com"

# Sign in with Apple (login provider)
# APPLE_BUNDLE_ID: iOS app bundle id (native mobile sign-in)
# APPLE_SERVICE_ID / TEAM_ID / KEY_ID / PRIVATE_KEY: web sign-in (Services ID + .p8 key)
APPLE_BUNDLE_ID=""
APPLE_SERVICE_ID=""
APPLE_TEAM_ID=""
APPLE_KEY_ID=""
APPLE_PRIVATE_KEY=""

# ==============================================================================
# 8. Single Sign-On (Generic OAuth 2.0 / DOS ID via PKCE Bridge)
# ==============================================================================
# Enable Generic OAuth 2.0 / OIDC authentication provider
POSTIZ_GENERIC_OAUTH="true"
# Button display label on login and registration pages
NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME="DOS ID"
# Logo icon URL for the SSO provider button
NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL="/icons/generic-oauth.svg"
# Central IdP / PKCE Bridge base URL
POSTIZ_OAUTH_URL="https://api.dos.me"
# OAuth 2.0 authorization endpoint URL
POSTIZ_OAUTH_AUTH_URL="https://api.dos.me/sso/authorize"
# OAuth 2.0 token exchange endpoint URL
POSTIZ_OAUTH_TOKEN_URL="https://api.dos.me/sso/token"
# OIDC userinfo profile endpoint URL
POSTIZ_OAUTH_USERINFO_URL="https://api.dos.me/sso/userinfo"
# OAuth 2.0 Client ID registered on the IdP
POSTIZ_OAUTH_CLIENT_ID="crove-postiz"
# OAuth 2.0 Client Secret
POSTIZ_OAUTH_CLIENT_SECRET="sample_oauth_client_secret_string"
# Requested OAuth scopes
POSTIZ_OAUTH_SCOPE="openid profile email organizations offline_access"

# ==============================================================================
# 9. Ecosystem & First-Party Bootstrap Integration (DOS.AI / DOS-Me / Crove OS)
# ==============================================================================
# Enable ecosystem-level 2-tier sync and headless provisioning (true/false)
ENABLE_ECOSYSTEM_SYNC="false"
# Ecosystem provider identifier
ECOSYSTEM_PROVIDER="dos"
# Central ecosystem API endpoint for outbound entity delegation
ECOSYSTEM_API_URL="https://api.dos.me"
# HMAC-SHA256 secret for verifying inbound webhook events (/api/webhooks/dos-org-sync)
DOS_SYNC_WEBHOOK_SECRET="sample_dos_sync_webhook_secret_key"
# Legacy webhook secret alias
DOS_WEBHOOK_SECRET="sample_dos_webhook_secret_key"
# Bearer secret token for First-Party Headless Provisioning (/v1/provision)
PROVISIONING_SECRET_KEY="sample_provisioning_secret_bearer_key"
# Legacy provisioning secret alias
DOS_PROVISIONING_SECRET="sample_dos_provisioning_secret_key"
# Internal service authentication API key
INTERNAL_API_KEY="sample_internal_service_api_key"
# First-Party OAuth Client ID for signed M2M bootstrap
CROVE_POST_CLIENT_ID="crove-post-client-id-sample"
# First-Party OAuth Client Secret
CROVE_POST_CLIENT_SECRET="sample_crove_post_client_secret"
# HMAC secret for signed M2M bootstrap requests (/api/internal/first-party/bootstrap)
CROVE_POST_BOOTSTRAP_SIGNING_SECRET="sample_bootstrap_hmac_signing_secret"

# ==============================================================================
# 10. AI Providers & OpenAI-Compatible Gateway Settings (BYOK / DOS.AI / OpenAI)
# ==============================================================================
# OpenAI API Key or OpenAI-compatible Gateway Bearer token
OPENAI_API_KEY="sk-proj-sample-openai-api-key-or-gateway-token"
# Custom OpenAI-compatible Base URL (e.g. DOS.AI AI Gateway, LiteLLM, vLLM, DeepSeek, Ollama)
# Leave blank for official OpenAI (https://api.openai.com/v1)
OPENAI_BASE_URL="https://api.dos.ai/v1"
# Default LLM model identifier for text generation and social post drafting
OPENAI_MODEL_NAME="gpt-4.1"
# Default image generation model identifier
OPENAI_IMAGE_MODEL="chatgpt-image-latest"
# OAuth client ID for ChatGPT app integration (optional)
OPENAI_OAUTH_CLIENT_ID="sample_openai_oauth_client_id"
# OpenAI App domain verification challenge string (optional)
OPENAI_APP_CHALLANGE="sample_openai_app_challenge_token"
# EvoLink API key for Seedance AI video generation (https://evolink.ai)
EVOLINK_API_KEY="sample_evolink_api_key"
# Tavily AI Search API Key for real-time web grounding in agent workflows (optional)
TAVILY_API_KEY="tvly-sample_tavily_api_key"
# Fal.ai API Key for image and video rendering generation (optional)
FAL_KEY="sample_fal_ai_api_key"
# Chatbase chatbot embedding token (optional)
CHATBASE_TOKEN="sample_chatbase_token"
# Agent Media SSO signing key (optional)
AGENT_MEDIA_SSO_KEY="sample_agent_media_sso_key"

# ==============================================================================
# 11. Social Media & Channel Integrations (28+ Providers)
# ==============================================================================
# --- X (Twitter) ---
X_URL="https://api.x.com"
X_API_KEY="sample_x_consumer_api_key"
X_API_SECRET="sample_x_consumer_api_secret"
DISABLE_X_ANALYTICS="false"
STRIP_LINKS_FROM_X_POSTS="false"

# --- LinkedIn ---
LINKEDIN_CLIENT_ID="sample_linkedin_client_id"
LINKEDIN_CLIENT_SECRET="sample_linkedin_client_secret"

# --- Reddit ---
# Both connect AND refresh run through the dos.me Reddit OAuth broker
# (DOS_ME_API_URL, auth key = DOS_ME_INTERNAL_API_KEY) - no Reddit client
# credentials are needed in Crove env at all.
# Optional override for the broker product label (auto-detected from
# FRONTEND_URL: beta-post.crove.com -> crove-post-beta, else crove-post-prod).
# REDDIT_BROKER_PRODUCT="crove-post-beta"

# --- GitHub ---
GITHUB_CLIENT_ID="sample_github_oauth_client_id"
GITHUB_CLIENT_SECRET="sample_github_oauth_client_secret"

# --- Threads (Meta) ---
THREADS_APP_ID="1234567890123456"
THREADS_APP_SECRET="sample_threads_app_secret_hex"

# --- Facebook (Meta Graph API) ---
FACEBOOK_APP_ID="1234567890123456"
FACEBOOK_APP_SECRET="sample_facebook_app_secret_hex"

# --- Instagram (Meta Graph API & Standalone) ---
INSTAGRAM_APP_ID="1234567890123456"
INSTAGRAM_APP_SECRET="sample_instagram_app_secret_hex"

# --- YouTube & Google Business Messages (Google Cloud Platform) ---
YOUTUBE_CLIENT_ID="sample_google_client_id.apps.googleusercontent.com"
YOUTUBE_CLIENT_SECRET="sample_google_client_secret"
GOOGLE_GMB_CLIENT_ID="sample_google_client_id.apps.googleusercontent.com"
GOOGLE_GMB_CLIENT_SECRET="sample_google_client_secret"

# --- TikTok (Consumer & Business API) ---
TIKTOK_CLIENT_ID="sample_tiktok_consumer_client_key"
TIKTOK_CLIENT_SECRET="sample_tiktok_consumer_client_secret"
TIKTOK_BUSINESS_CLIENT_ID="sample_tiktok_business_client_id"
TIKTOK_BUSINESS_CLIENT_SECRET="sample_tiktok_business_client_secret"

# --- Pinterest ---
PINTEREST_CLIENT_ID="1234567"
PINTEREST_CLIENT_SECRET="sample_pinterest_client_secret_hex"

# --- Discord ---
DISCORD_CLIENT_ID="123456789012345678"
DISCORD_CLIENT_SECRET="sample_discord_client_secret"
DISCORD_BOT_TOKEN_ID="sample_discord_bot_token_string"

# --- Telegram ---
TELEGRAM_TOKEN="1234567890:SAMPLE_TELEGRAM_BOT_TOKEN"
TELEGRAM_BOT_NAME="Sample_Bot"

# --- Twitch ---
TWITCH_CLIENT_ID="sample_twitch_client_id"
TWITCH_CLIENT_SECRET="sample_twitch_client_secret"

# --- Kick ---
KICK_CLIENT_ID="sample_kick_client_id"
KICK_SECRET="sample_kick_client_secret"

# --- Slack ---
SLACK_ID="1234567890.1234567890"
SLACK_SECRET="sample_slack_client_secret"
SLACK_SIGNING_SECRET="sample_slack_signing_secret"

# --- Mastodon ---
MASTODON_URL="https://mastodon.social"
MASTODON_CLIENT_ID="sample_mastodon_client_id"
MASTODON_CLIENT_SECRET="sample_mastodon_client_secret"

# --- Dribbble ---
DRIBBBLE_CLIENT_ID="sample_dribbble_client_id"
DRIBBBLE_CLIENT_SECRET="sample_dribbble_client_secret"

# --- Tumblr ---
TUMBLR_CLIENT_ID="sample_tumblr_client_id"
TUMBLR_CLIENT_SECRET="sample_tumblr_client_secret"
# Misc Settings
OPENAI_API_KEY=""
# OAuth client configured for the ChatGPT app. Only this client can receive
# verified user email claims for ChatGPT Enterprise domain restrictions.
OPENAI_OAUTH_CLIENT_ID=""
# MCP OAuth Dynamic Client Registration (RFC 7591) redirect-domain allowlist.
# When set (comma separated), POST /oauth/register only accepts redirect_uris
# whose host matches a listed domain or one of its subdomains; unset or empty
# means any client can self-register. Only https callbacks are checked:
# loopback (http://localhost:8787/callback - Grok, Claude Code) and
# private-use scheme callbacks (cursor://...) stay on the user's machine
# and are always accepted. Example locks web callbacks to the claude.ai
# connector; add cursor.com for Cursor.
# DCR_VERIFIED_DOMAINS="claude.ai,claude.com"
# Postiz Cloud only: lets people connect a self-hosted Postiz on the MCP
# consent screen ("Use self-hosted"). The MCP tool calls of that connection
# are relayed to the instance with its API key. Leave unset on self-hosted
# installs; set it on both the API and the MCP backend.
# MCP_SELF_HOSTED_RELAY=true
# EVOLINK_API_KEY="" # EvoLink API key for Seedance AI video generation (https://evolink.ai)
NEXT_PUBLIC_DISCORD_SUPPORT=""
NEXT_PUBLIC_POLOTNO=""
# NOT_SECURED=false
API_LIMIT=30 # The limit of the public API hour limit

# --- VK (VKontakte) ---
VK_ID="12345678"

# --- Whop ---
WHOP_CLIENT_ID="sample_whop_client_id"

# --- MeWe ---
MEWE_HOST="https://mewe.com"
MEWE_APP_ID="sample_mewe_app_id"
MEWE_API_KEY="sample_mewe_api_key"

# DOS shared billing — Crove sells DOS Plus ($9) / Pro ($19), not Postiz Stripe packages.
# Keep STRIPE_PUBLISHABLE_KEY set so channel gating stays on. Checkout goes to DOS-Me.
# DOS_SHARED_BILLING=true
# DOS_ME_API_URL=https://api.dos.me
# DOS_ME_INTERNAL_API_KEY=""

# Developer Settings
NX_ADD_PLUGINS=false
IS_GENERAL="true" # required for now
NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME="Authentik"
NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL="https://raw.githubusercontent.com/walkxcode/dashboard-icons/master/png/authentik.png"
POSTIZ_GENERIC_OAUTH="false"
POSTIZ_OAUTH_URL="https://auth.example.com"
POSTIZ_OAUTH_AUTH_URL="https://auth.example.com/application/o/authorize"
POSTIZ_OAUTH_TOKEN_URL="https://auth.example.com/application/o/token"
POSTIZ_OAUTH_USERINFO_URL="https://authentik.example.com/application/o/userinfo"
POSTIZ_OAUTH_CLIENT_ID=""
POSTIZ_OAUTH_CLIENT_SECRET=""
# POSTIZ_OAUTH_SCOPE="openid profile email" # default values
# --- Farcaster (Neynar API) ---
NEYNAR_CLIENT_ID="sample_neynar_client_id"
NEYNAR_SECRET_KEY="sample_neynar_secret_key"
NEYNAR_LOGIN_URL="https://app.neynar.com/login"

# --- Sign in with Apple ---
APPLE_BUNDLE_ID="com.example.postiz.mobile"
APPLE_SERVICE_ID="com.example.postiz.web"
APPLE_CLIENT_ID="com.example.postiz.web"
APPLE_APP_BUNDLE_ID="com.example.postiz.ios"
APPLE_TEAM_ID="SAMPLE_TEAM_ID"
APPLE_KEY_ID="SAMPLE_KEY_ID"
APPLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nSAMPLE_APPLE_PRIVATE_KEY\n-----END PRIVATE KEY-----"

# ==============================================================================
# 12. Browser Extension, Canvas & Short Links
# ==============================================================================
# Chrome Extension Store ID (for cookie-based platform authentications e.g. Skool)
EXTENSION_ID="sample_chrome_extension_id_32_chars"
# Polotno Studio Canvas Editor API Key (optional)
NEXT_PUBLIC_POLOTNO="sample_polotno_key"
# Dub.co Short Link Service API Key
DUB_TOKEN="dub_sample_token"
DUB_API_ENDPOINT="https://api.dub.co"
DUB_SHORT_LINK_DOMAIN="dub.sh"
# Short.io API Key
SHORT_IO_SECRET_KEY="shortio_sample_secret_key"
# Kutt.it Short Link Service API Key
KUTT_API_KEY="kutt_sample_api_key"
KUTT_API_ENDPOINT="https://kutt.it/api/v2"
KUTT_SHORT_LINK_DOMAIN="kutt.it"
# LinkDrip Short Link API Key
LINK_DRIP_API_KEY="linkdrip_sample_api_key"
LINK_DRIP_API_ENDPOINT="https://api.linkdrip.com/v1/"
LINK_DRIP_SHORT_LINK_DOMAIN="dripl.ink"
# Transloadit Video Transcoding & Processing Keys
TRANSLOADIT_AUTH="sample_transloadit_auth_key"
TRANSLOADIT_TEMPLATE="sample_transloadit_template_id"

# ==============================================================================
# 13. Security, SSRF & Provider Routing Settings
# ==============================================================================
# Disable SSRF protection for self-hosted instances on private VPC networks (true/false)
DISABLE_SSRF_PROTECTION="false"
# MCP Dynamic Client Registration (RFC 7591) allowed redirect domains (comma-separated)
DCR_VERIFIED_DOMAINS="claude.ai,claude.com,chatgpt.com"
# Providers hidden from the Connect Channel modal (comma-separated)
HIDDEN_PROVIDERS=""
# Provider identifier migration mappings (comma-separated old:new pairs)
MIGRATE_PROVIDERS="tiktok:tiktok-business"
# Add Nx bundler plugins flag
NX_ADD_PLUGINS="false"

# ==============================================================================
# 14. Stripe & In-App Purchase Billing (RevenueCat / Stripe)
# ==============================================================================
# Platform fee percentage (0.05 = 5%)
FEE_AMOUNT="0.05"
# Stripe Publishable API Key
STRIPE_PUBLISHABLE_KEY="pk_test_51SAMPLE_STRIPE_PUBLISHABLE_KEY"
# Stripe Secret API Key
STRIPE_SECRET_KEY="sk_test_51SAMPLE_STRIPE_SECRET_KEY"
# Stripe Webhook Signing Secret
STRIPE_SIGNING_KEY="whsec_sample_stripe_webhook_signing_secret"
# Stripe Connect Webhook Signing Secret
STRIPE_SIGNING_KEY_CONNECT="whsec_sample_stripe_connect_signing_secret"
# Stripe coupon / promotional discount ID
STRIPE_DISCOUNT_ID="sample_stripe_coupon_discount_id"
# RevenueCat Secret Key (App Store & Google Play subscriptions)
REVENUECAT_SECRET_KEY="sample_revenuecat_secret_key"
# RevenueCat Webhook Authorization Header Secret
REVENUECAT_WEBHOOK_SECRET="sample_revenuecat_webhook_secret"
# Reject sandbox in-app purchases in production mode (true/false)
IN_APP_PURCHASE_REJECT_SANDBOX="false"

# =======================================================================# 15. Telemetry, Observability & Analytics
# ==============================================================================
# Sentry DSN for error reporting
NEXT_PUBLIC_SENTRY_DSN="https://sample_sentry_key@o0.ingest.sentry.io/0000000"
# Enable Sentry Spotlight debugging tool (1: on, 0: off)
SENTRY_SPOTLIGHT="0"
# Build application version identifier
NEXT_PUBLIC_APP_VERSION="2.0.0"
# Datafast Website ID for web analytics
DATAFAST_WEBSITE_ID="sample_datafast_website_id"
# Datafast API Key for goal tracking
DATAFAST_API_KEY="sample_datafast_api_key"
# Google Tag Manager ID
NEXT_PUBLIC_GTM_ID="GTM-SAMPLE01"
# Google Ads conversion tracking label for trials
NEXT_PUBLIC_TRACKING_TRIAL="sample_tracking_trial_label"
# PostHog Project API Key
NEXT_PUBLIC_POSTHOG_KEY="phc_sample_posthog_project_key"
# PostHog API Host URL
NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
# Meta (Facebook) Pixel ID
NEXT_PUBLIC_FACEBOOK_PIXEL="123456789012345"
# Meta Conversion API Access Token
FACEBOOK_PIXEL_ACCESS_TOKEN="sample_facebook_pixel_access_token"
# Discord Support Server Widget URL
NEXT_PUBLIC_DISCORD_SUPPORT="https://discord.gg/example"
# reCAPTCHA Settings (invisible v2 on anonymous preview comments, optional; unset = no captcha)
# RECAPTCHA_SITE_KEY="" # Your reCAPTCHA v2 invisible site key
# RECAPTCHA_SECRET_KEY="" # Your reCAPTCHA v2 invisible secret key

# Provider visibility / migration
# HIDDEN_PROVIDERS="tiktok" # comma-separated identifiers hidden from the add-channel screen
# MIGRATE_PROVIDERS="tiktok:tiktok-business" # comma-separated "old:new" pairs, a reconnect of "old" goes through "new" and the channel is migrated in place