From ac185234fa003c440b8bd9615b7ba5373fcbbc99 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Wed, 12 Aug 2026 11:29:41 +0000 Subject: [PATCH] docs: correct the dead WorkOS hosts and canonical origin in .env.example .env.example still told anyone copying it to set WORKOS_API_HOSTNAME=api.identity.nyuchi.com That host was detached in the Aug 2026 issuer migration: it resolves but refuses connections (curl 000), so a fresh checkout following the example gets a hosted sign-in redirect that succeeds and a /callback code exchange that fails -- the exact split the file's own warning above it describes. next.config.ts already documents the migration correctly; only the example was left behind. Corrected to auth.mukoko.com (the WorkOS auth API, where SDK calls and the JWKS fetch go) and added the missing WORKOS_AUTHKIT_DOMAIN with accounts.mukoko.com (the AuthKit issuer -- the OAuth 2.1 authorization server every .well-known route and /auth.md advertises). Both carry a note on what the host is and is not, since advertising the auth API where the issuer belongs produces metadata that validates but dead-ends at discovery. Also fixes NEXT_PUBLIC_SITE_URL, which the example set to nhimbe.com while the code default and the documented canonical origin are events.mukoko.com. Production is dual-domain, but that variable picks the ONE origin every canonical tag, OG image, sitemap entry, JSON-LD block and .well-known resource points at -- so the example was quietly repointing all of them at the secondary domain. NEXT_PUBLIC_WORKOS_REDIRECT_URI now matches it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u --- .env.example | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/.env.example b/.env.example index 2cf10edb..34a0dabb 100644 --- a/.env.example +++ b/.env.example @@ -21,13 +21,25 @@ WORKOS_CLIENT_ID=client_... WORKOS_API_KEY=sk_... # Session-cookie encryption key, >= 32 chars. WORKOS_COOKIE_PASSWORD= -# Optional. Defaults to api.workos.com; set to api.identity.nyuchi.com to -# route WorkOS API calls through the Nyuchi custom API domain. (The hosted -# AuthKit sign-in UI is served separately from identity.nyuchi.com, configured -# in the WorkOS dashboard — not via this variable.) -WORKOS_API_HOSTNAME=api.identity.nyuchi.com +# Optional. Defaults to api.workos.com; set to auth.mukoko.com to route WorkOS +# API calls — and the bearer-token verifier's JWKS fetch — through the custom +# API domain. This is the WorkOS *auth API*, NOT the authorization server: +# auth.mukoko.com serves no authorization-server metadata, so pointing issuer +# discovery at it dead-ends. The hosted AuthKit sign-in UI is a different host +# again (see WORKOS_AUTHKIT_DOMAIN below). +# Was api.identity.nyuchi.com before the Aug 2026 migration; that host no +# longer resolves, so a stale value fails at the code exchange. +WORKOS_API_HOSTNAME=auth.mukoko.com +# Optional. The hosted AuthKit domain — the OAuth 2.1 authorization server MCP +# clients discover (/oauth2/{authorize,token,register,jwks}, DCR enabled), and +# what every .well-known/* route and /auth.md advertises. Code default is +# accounts.mukoko.com; override per environment. WORKOS_ISSUER is accepted as +# the preferred spelling. Also formerly identity.nyuchi.com — now dead DNS. +WORKOS_AUTHKIT_DOMAIN=accounts.mukoko.com # Usually ${NEXT_PUBLIC_SITE_URL}/callback. The NEXT_PUBLIC_ prefix is required. -NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://nhimbe.com/callback +# Both production origins have a /callback registered in WorkOS; this points at +# the primary one, matching NEXT_PUBLIC_SITE_URL below. +NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://events.mukoko.com/callback # Signing secret for the WorkOS event webhook (POST /api/webhooks/workos) — # guaranteed user provisioning (user.* → identity.persons, # organization_membership.* → entity.memberships). Copy it from the webhook @@ -49,7 +61,14 @@ SHAMWARI_AI_GATEWAY_AUTH_TOKEN= RESEND_API_KEY= # --- Public site config ---------------------------------------------------- -NEXT_PUBLIC_SITE_URL=https://nhimbe.com +# The PRIMARY/canonical origin, not merely "a" domain the app answers on. +# Production is dual-domain (nhimbe.com + events.mukoko.com both serve the app), +# but every self-referential URL — canonical tags, OG/Twitter images, +# sitemap.xml, robots.txt, JSON-LD, the .well-known OAuth `resource` — is +# consolidated onto this one origin so SEO signals don't split across both. +# Matches the code default in src/lib/site-url.ts; setting it to nhimbe.com +# instead would repoint all of those at the secondary domain. +NEXT_PUBLIC_SITE_URL=https://events.mukoko.com # Maps + address search run on OpenStreetMap: Leaflet renders key-less OSM # tiles client-side, and geocoding is DB-first (places.places) then OSM # Nominatim (nominatim.openstreetmap.org) server-side — no Maps API key needed.