# ---- GitHub OAuth (app-native auth, server-only) ----
# From your GitHub OAuth App (Settings > Developer settings > OAuth Apps).
# All server-only — NEVER prefix with NEXT_PUBLIC_.
GITHUB_OAUTH_CLIENT_ID=Iv1.your-client-id
GITHUB_OAUTH_CLIENT_SECRET=your-client-secret
# Callback is derived at runtime from the request origin (${origin}/auth/callback)
# — no callback env needed. The OAuth App's registered Authorization callback URL
# must match the host you serve on (prod = https://llmapikey.vercel.app/auth/callback,
# local dev = http://localhost:3000/auth/callback). GitHub OAuth Apps allow only
# ONE callback, so reach the app on its canonical domain.
# Session signing secret (HS256). >=32 bytes. Generate: openssl rand -base64 48
AUTH_SESSION_SECRET=change-me-to-a-32-byte-or-longer-random-string

# ---- Postgres (direct, server-only) ----
# Supabase pooler connection string. The Supabase Vercel integration provisions
# this as POSTGRES_URL (Transaction pooler, port 6543). Reaches the unexposed
# `llmapikey` schema. NEVER expose to the client. The connecting role must
# own/bypass RLS on the llmapikey schema (project `postgres` user).
POSTGRES_URL=postgresql://postgres.your-ref:password@aws-0-region.pooler.supabase.com:6543/postgres

# ---- OpenRouter (server-only secret) ----
# Master management/provisioning key used to mint per-user keys. NEVER expose to
# the client.
OPENROUTER_MANAGEMENT_KEY=sk-or-v1-provisioning-...
# Workspace the minted keys are created in (create-key `workspace_id`). Omit to
# fall back to the management key's default workspace.
OPENROUTER_WORKSPACE_ID=33179556-3ab3-40a4-af8b-211d322aa94e

# ---- Provisioning controls (server-only) ----
# Project lifecycle. Fail-closed: unset/unknown values are treated as "pending".
# Keep "pending" until a provider can safely support the free monthly giveaway.
# Set to "live" only after provider and billing risks are accepted.
PROJECT_STATUS=pending
# Feature flag: even when PROJECT_STATUS=live, live key minting stays OFF unless
# this is also "true". When "false", generateKey() refuses to mint.
PROVISIONING_ENABLED=false
# Sybil/abuse kill-switch: stop minting once this many active keys exist.
MAX_TOTAL_KEYS=500
# Per-key daily spend cap (USD) sent to OpenRouter.
KEY_DAILY_LIMIT_USD=10
# Key lifetime in days (sets expires_at on mint).
KEY_EXPIRY_DAYS=90

# ---- Admin (server-only) ----
# Comma-separated numeric GitHub provider_ids granted access to /admin.
# These are the immutable numeric ids (provider_id), NOT GitHub logins.
# Empty/unset = no admins (fail-closed); /admin returns 404 for everyone.
ADMIN_GITHUB_USER_IDS=