.env.example

# Server
PORT=3000
NODE_ENV=development
ADMIN_API_KEY=admin-secret-dev

# RemitFlow settings
DEFAULT_BASE_CURRENCY=USD
TRANSFER_FEE_PERCENT=1.5
TRANSFER_FEE_FLAT=0.30

# Largest single transfer amount accepted (source currency)
MAX_TRANSFER_AMOUNT=50000

# Mock Stellar settings
STELLAR_NETWORK=testnet

# CORS (use "*" to allow any origin)
CORS_ORIGIN=*

# Rate limiting (per client IP, applied to /api)
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=100

# Error tracking
ERROR_TRACKING_ENABLED=true
ERROR_TRACKING_LEVEL=error

# Request limits
BODY_LIMIT=100kb
REQUEST_TIMEOUT_MS=15000

# Database connection pooling
DB_POOL_MIN=2
DB_POOL_MAX=10
DB_POOL_IDLE_TIMEOUT_MS=30000
DB_POOL_CONNECTION_TIMEOUT_MS=2000

# Caching
CACHE_DEFAULT_POLICY=no-store
CACHE_RATES_MAX_AGE_SECONDS=10

# History pagination (GET /api/transfers, GET /api/audit)
PAGINATION_DEFAULT_LIMIT=50
# Requests above this limit are rejected with 400, not clamped.
PAGINATION_MAX_LIMIT=200
# Max records a single history query may examine before returning a
# resumable, truncated page.
PAGINATION_MAX_SCAN=10000
# HMAC key used to sign pagination cursors. Left unset a random key is
# generated per process; set it explicitly when running more than one instance,
# or cursors minted by one will be rejected by another.
# PAGINATION_CURSOR_SECRET=

# API Token authentication
# JSON map of token → array of scopes. If omitted, hardcoded demo tokens are used.
# Valid scopes: transfers:read, transfers:write, users:read, users:write, audit:read
# Example (single line, properly escaped for shell):
# API_TOKENS={"my-secret-token":["transfers:read","transfers:write","users:read","users:write","audit:read"]}