.env.github.example

# GitHub OAuth App credentials for live integration testing.
#
# Copy to .env.github (gitignored) and fill in real values.
# .env.github MUST NEVER be committed.
#
# These power the `github_check` validation mode (R-S-13): GitHub
# access tokens are opaque, so quack-oauth validates them by POSTing
# `https://api.github.com/applications/{client_id}/token` with the
# OAuth App's credentials as HTTP Basic. The App must therefore exist
# and you must possess its client_secret -- a PAT or a `gh auth` token
# alone is NOT sufficient because the validation endpoint requires the
# issuing App's secret to authenticate the introspection call itself.
#
# Setup steps:
#   1. github.com → Settings → Developer settings → OAuth Apps → New OAuth App
#      (NOT a GitHub App; the validation endpoint is OAuth-App-only.)
#   2. Note the `Client ID` -- starts with `Iv1.` or `Ov23li...`.
#      That value is the App's client_id; quack-oauth substitutes it
#      into the validation URL and uses it as HTTP Basic user.
#   3. Generate a client secret. Copy the value once (GitHub shows it
#      exactly once).
#   4. To exercise the positive path, authorize a user against the App
#      (e.g. via the OAuth Web Flow or `gh auth login --client-id ...`)
#      and capture the resulting `gho_*` user-to-server token.

# OAuth App `Client ID`. Public-ish (visible in any OAuth redirect URL).
QUACK_OAUTH_GITHUB_CLIENT_ID=

# OAuth App client secret. Sensitive -- treat like a password.
QUACK_OAUTH_GITHUB_CLIENT_SECRET=

# A `gho_*` user-to-server access token issued for the App above to
# exercise the positive validation path. The token's owning user must
# have authorized your OAuth App. Optional -- the capture script can
# also be run against the `gh` CLI's token if you only want to verify
# the network path (it'll return 404 because the App didn't issue it).
QUACK_OAUTH_GITHUB_ACCESS_TOKEN=