.env.example

# ---------------------------------------------------------------------------
# SignalShield — example environment configuration
# Copy to ".env" and fill in your own values:   cp .env.example .env
# NEVER commit your real .env (it is git-ignored). Access tokens are secrets.
# ---------------------------------------------------------------------------

# --- Core ------------------------------------------------------------------
# HTTP port to listen on.
PORT=8787

# development | production | test
NODE_ENV=development

# Comma-separated list of browser origins allowed by CORS.
# In production an empty list means browser requests carrying an Origin are
# REFUSED. Example: https://your-store.com,https://www.your-store.com
ALLOWED_ORIGINS=https://your-store.com

# A client-supplied event_time older than this (seconds) — or in the future —
# is replaced by the server clock. Default: 7 days.
MAX_EVENT_AGE_SECONDS=604800

# --- Meta Conversions API --------------------------------------------------
# Set to "true" to forward anonymized signals to Meta.
META_ENABLED=true
# Your Meta Pixel / Dataset ID.
META_PIXEL_ID=YOUR_PIXEL_ID
# CAPI access token. SECRET — never logged, never committed.
META_ACCESS_TOKEN=YOUR_CAPI_ACCESS_TOKEN
# Graph API version.
META_API_VERSION=v19.0
# Optional test code; honored ONLY when NODE_ENV is not "production".
META_TEST_EVENT_CODE=

# --- Google Enhanced Conversions ------------------------------------------
# Set to "true" to forward anonymized signals to Google.
GOOGLE_ENABLED=false
# Google Ads customer ID (digits only, no dashes).
GOOGLE_CUSTOMER_ID=YOUR_CUSTOMER_ID
# Conversion action ID.
GOOGLE_CONVERSION_ACTION_ID=YOUR_CONVERSION_ACTION_ID
# Google Ads developer token. SECRET.
GOOGLE_DEVELOPER_TOKEN=YOUR_DEVELOPER_TOKEN
# OAuth 2.0 bearer access token. SECRET.
GOOGLE_ACCESS_TOKEN=YOUR_OAUTH_ACCESS_TOKEN