PORT=3003
DATABASE_URL=postgresql://sauci:sauci_local_only@127.0.0.1:54320/sauci
SUPABASE_AUTH_URL=https://your-project.supabase.co
SUPABASE_AUTH_AUDIENCE=authenticated

# Server-only hosted Auth Admin credential. Used for account deletion and for
# enriching admin user lists; it is never exposed to the browser or used as a
# Supabase database client.
# SUPABASE_AUTH_SERVICE_ROLE_KEY=

# Optional overrides. The issuer defaults to <SUPABASE_AUTH_URL>/auth/v1 and
# the JWKS endpoint defaults to <SUPABASE_AUTH_URL>/auth/v1/.well-known/jwks.json.
# SUPABASE_AUTH_ISSUER=
# SUPABASE_AUTH_JWKS_URL=

# Test-only. Startup fails if this is set outside NODE_ENV=test.
# AUTH_TEST_JWKS={"keys":[]}

# Optional stable credential for non-browser admin clients such as MCP. MCP
# receives the token as SAUCI_ADMIN_API_TOKEN; it does not receive the user ID.
# Both values are required together. The user ID must belong to an active,
# least-privilege admin_users row; generate a random token of at least 32 chars.
# ADMIN_API_SERVICE_TOKEN=
# ADMIN_API_SERVICE_USER_ID=00000000-0000-4000-8000-000000000002

# Optional admin review decryption. Keep the private JWK server-side only.
# ADMIN_PRIVATE_KEY_JWK=

# Optional local fixture identity used by `npm run db:seed -w @sauci/api`.
# SEED_USER_ID=00000000-0000-4000-8000-000000000001
# SEED_USER_EMAIL=local@sauci.test