fix: correct the dead WorkOS hosts and canonical origin in .env.example

[bryanfawcett]

Found while fixing the same stale host in three deployed worker configs across nyuchi/nyuchi-docs and nyuchi/mukoko-platform. This repo's runtime config is fine — next.config.ts already documents the Aug 2026 issuer migration correctly, and src/lib/auth/workos-metadata.ts defaults to accounts.mukoko.com. Only .env.example was left behind, which matters because it is the file people copy.

The dead host

$ getent hosts identity.nyuchi.com          → no output (NO DNS RECORD)
$ getent hosts api.identity.nyuchi.com      → resolves
$ curl -s -o /dev/null -w '%{http_code}' https://api.identity.nyuchi.com/  → 000 (refuses connections)
$ curl -s -o /dev/null -w '%{http_code}' https://auth.mukoko.com/          → 200
$ curl -s https://accounts.mukoko.com/.well-known/openid-configuration     → 200, issuer accounts.mukoko.com

.env.example told anyone copying it to set WORKOS_API_HOSTNAME=api.identity.nyuchi.com. A fresh checkout following it gets a hosted sign-in redirect that succeeds and a /callback code exchange that fails — precisely the environment-split failure the warning a few lines above it describes, which is a miserable thing to debug because the failure is nowhere near the cause.

Changes

Variable	Was	Now
WORKOS_API_HOSTNAME	api.identity.nyuchi.com (dead)	auth.mukoko.com — the WorkOS auth API, where SDK calls and the bearer verifier's JWKS fetch go
WORKOS_AUTHKIT_DOMAIN	absent	accounts.mukoko.com — the AuthKit issuer, the OAuth 2.1 authorization server every .well-known/* route and /auth.md advertises
NEXT_PUBLIC_SITE_URL	https://nhimbe.com	https://events.mukoko.com
NEXT_PUBLIC_WORKOS_REDIRECT_URI	https://nhimbe.com/callback	https://events.mukoko.com/callback (matches the above)

Both host comments now state what the host is not, because the two are not interchangeable: auth.mukoko.com serves no authorization-server metadata, so a client following an issuer pointer there finds no discovery document and the flow dies before sign-in. That is the mistake the comment exists to prevent.

Why NEXT_PUBLIC_SITE_URL was also wrong

Production is genuinely dual-domain — both nhimbe.com and events.mukoko.com serve the app — so nhimbe.com looks harmless. But this variable does not pick "a domain the app answers on", it picks the one origin that every self-referential URL points at: canonical tags, OG/Twitter images, sitemap.xml, robots.txt, schema.org JSON-LD, and the .well-known OAuth resource. The documented primary and the code default in src/lib/site-url.ts are both events.mukoko.com, so the example was quietly repointing all of those at the secondary domain — the duplicate-content split the consolidation exists to avoid.

Deliberately left alone

• The webhook comment's https://nhimbe.com/api/webhooks/workos — that is the endpoint actually registered in the WorkOS dashboard, so it is a true statement about what exists, not a stale default.
• RELEASES.md's mention of the old authenticate.nyuchi.com / identity.nyuchi.com pair — release notes are a historical record of what shipped then, and rewriting history to match today's hosts would make them wrong in a different way.
• next.config.ts — already correct, and already says the old pair no longer resolves.

No code changes, so no behaviour change: .env.example is not read at build or runtime.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nhimbe	Ready	Preview	Aug 12, 2026 11:30am

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}