Skip to content

fix: correct the dead WorkOS hosts and canonical origin in .env.example #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bryanfawcett merged 1 commit into from
Aug 12, 2026
Merged

fix: correct the dead WorkOS hosts and canonical origin in .env.example #130

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 26 additions & 7 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,25 @@ WORKOS_CLIENT_ID=client_...
WORKOS_API_KEY=sk_...
# Session-cookie encryption key, >= 32 chars.
WORKOS_COOKIE_PASSWORD=
# Optional. Defaults to api.workos.com; set to api.identity.nyuchi.com to
# route WorkOS API calls through the Nyuchi custom API domain. (The hosted
# AuthKit sign-in UI is served separately from identity.nyuchi.com, configured
# in the WorkOS dashboard — not via this variable.)
WORKOS_API_HOSTNAME=api.identity.nyuchi.com
# Optional. Defaults to api.workos.com; set to auth.mukoko.com to route WorkOS
# API calls — and the bearer-token verifier's JWKS fetch — through the custom
# API domain. This is the WorkOS *auth API*, NOT the authorization server:
# auth.mukoko.com serves no authorization-server metadata, so pointing issuer
# discovery at it dead-ends. The hosted AuthKit sign-in UI is a different host
# again (see WORKOS_AUTHKIT_DOMAIN below).
# Was api.identity.nyuchi.com before the Aug 2026 migration; that host no
# longer resolves, so a stale value fails at the code exchange.
WORKOS_API_HOSTNAME=auth.mukoko.com
# Optional. The hosted AuthKit domain — the OAuth 2.1 authorization server MCP
# clients discover (/oauth2/{authorize,token,register,jwks}, DCR enabled), and
# what every .well-known/* route and /auth.md advertises. Code default is
# accounts.mukoko.com; override per environment. WORKOS_ISSUER is accepted as
# the preferred spelling. Also formerly identity.nyuchi.com — now dead DNS.
WORKOS_AUTHKIT_DOMAIN=accounts.mukoko.com
# Usually ${NEXT_PUBLIC_SITE_URL}/callback. The NEXT_PUBLIC_ prefix is required.
NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://nhimbe.com/callback
# Both production origins have a /callback registered in WorkOS; this points at
# the primary one, matching NEXT_PUBLIC_SITE_URL below.
NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://events.mukoko.com/callback
# Signing secret for the WorkOS event webhook (POST /api/webhooks/workos) —
# guaranteed user provisioning (user.* → identity.persons,
# organization_membership.* → entity.memberships). Copy it from the webhook
Expand All @@ -49,7 +61,14 @@ SHAMWARI_AI_GATEWAY_AUTH_TOKEN=
RESEND_API_KEY=

# --- Public site config ----------------------------------------------------
NEXT_PUBLIC_SITE_URL=https://nhimbe.com
# The PRIMARY/canonical origin, not merely "a" domain the app answers on.
# Production is dual-domain (nhimbe.com + events.mukoko.com both serve the app),
# but every self-referential URL — canonical tags, OG/Twitter images,
# sitemap.xml, robots.txt, JSON-LD, the .well-known OAuth `resource` — is
# consolidated onto this one origin so SEO signals don't split across both.
# Matches the code default in src/lib/site-url.ts; setting it to nhimbe.com
# instead would repoint all of those at the secondary domain.
NEXT_PUBLIC_SITE_URL=https://events.mukoko.com
# Maps + address search run on OpenStreetMap: Leaflet renders key-less OSM
# tiles client-side, and geocoding is DB-first (places.places) then OSM
# Nominatim (nominatim.openstreetmap.org) server-side — no Maps API key needed.
Expand Down
Loading