.env.example

# Since the ".env" file is gitignored, you can use the ".env.example" file to
# build a new ".env" file when you clone the repo. Keep this file up-to-date
# when you add new variables to `.env`.

# This file will be committed to version control, so make sure not to have any
# secrets in it. If you are cloning this repo, create a copy of this file named
# ".env" and populate it with your secrets.

# When adding additional environment variables, the schema in "/src/env.js"
# should be updated accordingly.

# --- Auth --------------------------------------------------------------------
# Session-signing secret. Generate with `openssl rand -base64 32`.
# Required (min 32 chars) in production.
BETTER_AUTH_SECRET=""

# Canonical public origin of the deployment, no trailing slash.
# Required in production — OAuth redirect URIs and trusted origins derive
# from it. Local dev: http://localhost:3000. Production: https://your-domain.
# The Google OAuth client must list <BETTER_AUTH_URL>/api/auth/callback/google
# as an authorized redirect URI.
BETTER_AUTH_URL="http://localhost:3000"

# Google OAuth client (Google Cloud Console → APIs & Services → Credentials).
# Powers sign-in plus the Gmail / Calendar integrations.
BETTER_AUTH_GOOGLE_CLIENT_ID=""
BETTER_AUTH_GOOGLE_CLIENT_SECRET=""

# Optional GitHub OAuth sign-in.
BETTER_AUTH_GITHUB_CLIENT_ID=""
BETTER_AUTH_GITHUB_CLIENT_SECRET=""

# --- Database ----------------------------------------------------------------
DATABASE_URL="postgresql://postgres:password@localhost:5432/superhuman"

# --- Integrations / AI -------------------------------------------------------
# Key-encryption key for Corsair's per-tenant credential store.
# Generate with `openssl rand -base64 32`.
CORSAIR_KEK=""
# Gemini API key (aistudio.google.com/apikey) for the assistant + triage.
GOOGLE_GENERATIVE_AI_API_KEY=""

# --- Realtime webhooks (optional) -------------------------------------------
# New emails and calendar invites are pushed by Google instead of polled.
# All three are optional; realtime stays off until WEBHOOK_PUBLIC_URL is set.
#
# 1. WEBHOOK_PUBLIC_URL: a public HTTPS base URL that reaches this app.
#    In development use a tunnel, e.g. `ngrok http 3000` or
#    `cloudflared tunnel --url http://localhost:3000`, and paste the URL here.
#    Calendar realtime only needs this — channels are registered automatically.
WEBHOOK_PUBLIC_URL=""
#
# 2. GMAIL_PUBSUB_TOPIC: Gmail pushes via Cloud Pub/Sub. One-time setup in the
#    Google Cloud project that owns your OAuth client:
#      a. Create a topic, e.g. gmail-push.
#      b. Grant Publish on the topic to gmail-api-push@system.gserviceaccount.com
#      c. Add a PUSH subscription to the topic with endpoint:
#         <WEBHOOK_PUBLIC_URL>/api/webhooks/corsair?token=<WEBHOOK_VERIFICATION_TOKEN>
#    Then set the full topic name here:
GMAIL_PUBSUB_TOPIC=""
#
# 3. WEBHOOK_VERIFICATION_TOKEN: any random string (`openssl rand -hex 16`).
#    Sent to Google when subscribing and required back on every delivery.
WEBHOOK_VERIFICATION_TOKEN=""