.env.example

# Postgres
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm?schema=public"

# Generate your own:  openssl rand -base64 32
BETTER_AUTH_SECRET=""

# Who is allowed to sign in — this is the entire authorisation model, so it has
# no default. Comma-separated, and each entry is either a whole email domain or
# a single address:
#
#   ALLOWED_SIGN_IN="acme.com"                       everyone at your company
#   ALLOWED_SIGN_IN="acme.com,contractor@gmail.com"  …plus one outsider
#   ALLOWED_SIGN_IN="you@gmail.com"                  a one-person install
#
# Subdomains count, so "acme.com" also admits "you@mail.acme.com".
ALLOWED_SIGN_IN=""

GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""


# ── Where things are ─────────────────────────────────────────────────────────
# Only needed when you deploy. The defaults below are the localhost ones.

# The API. Also the origin that mints session cookies and serves /api/auth/*.
# API_URL="http://localhost:3001"

# The web app. Comma-separate if it is served from more than one origin —
# the first is canonical, and the rest are simply allowed to call the API.
# APP_URL="http://localhost:3000"

# Only when the API and the app are on different subdomains of one parent,
# e.g. api.example.com and app.example.com — then set ".example.com" so one
# session cookie covers both.
# AUTH_COOKIE_DOMAIN=""

# The research agent, which is its own deployment.
# AGENT_URL="http://127.0.0.1:2000"

# Lets a signed-in rep talk to the agent from the contact sheet.
#
# The browser never calls the agent directly. The app proxies /eve/v1/* on its
# own origin, checks the session, and mints a two-minute token signed with this
# secret; the agent verifies it and learns *which rep* is asking. Set the same
# value for both processes.  openssl rand -base64 32
#
# Leave it unset and the Agent tab reports that it is not configured. Nothing
# else changes: the agent still runs on its own schedule.
# AGENT_BRIDGE_SECRET=""

# PORT="3001"


# ── Optional: what the agent can do ──────────────────────────────────────────
# The research agent works with none of these — it falls back to what the CRM
# already knows (your own email and calendar history) and simply reports what
# it could not check. Each key you add unlocks one more place it can look, and
# it tells you at startup which ones are on.

# Perplexity — finds where a person lives on the web, and recent news worth
# knowing before a call. https://perplexity.ai/settings/api
# PERPLEXITY_API_KEY=""

# LinkDAPI via RapidAPI — LinkedIn profiles: name, title, employer, tenure.
# https://rapidapi.com/linkdapi/api/linkdapi-best-unofficial-linkedin-api
# RAPIDAPI_KEY=""

# Context.dev — company logos, industry and socials from a domain.
# https://context.dev
# CONTEXT_DEV_API_KEY=""

# GitHub — raises the rate limit when matching contacts to GitHub profiles.
# Any classic token with no scopes will do.
# GITHUB_TOKEN=""

# Vercel Blob — mirrors profile pictures so they survive the source going away.
# Without it, avatars are linked rather than copied.
# BLOB_READ_WRITE_TOKEN=""

# The model the agent runs on is reached through the Vercel AI Gateway. On
# Vercel this is handled by OIDC and needs nothing; elsewhere, set a key.
# https://vercel.com/docs/ai-gateway
# AI_GATEWAY_API_KEY=""


# ── Optional: operations ─────────────────────────────────────────────────────

# Shared cache. Without it each instance caches in its own memory, which is
# correct — just not shared.
# REDIS_URL="redis://localhost:6379"
# CACHE_TTL_MS="60000"

# Bearer token guarding POST /internal/sync/google, the Gmail/Calendar cron
# route. The route refuses to run without it. At least 16 characters.
# CRON_SECRET=""

# Log every SQL statement Prisma runs, at debug level, without bound
# parameters. Off by default: it buries every other line under a wall of
# SELECTs.
# PRISMA_LOG_QUERIES="true"