.env.example

# Database (required) — use Neon, Supabase, Vercel Postgres, or Railway
# Per environment: Production and Preview MUST use SEPARATE databases. Preview
# builds run `prisma migrate deploy` and the demo sandbox creates/deletes rows,
# so a shared DB would let preview traffic mutate production data.
DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require

# Auth.js (required)
# Generate: openssl rand -base64 32
# Use a DISTINCT secret per environment (do not reuse the production value on
# Preview) so a session issued in one environment can't be trusted in another.
NEXTAUTH_SECRET=
# AUTH_URL / NEXTAUTH_URL — set these ONLY for local development.
#   Local:      http://localhost:3000 (both).
#   Preview:    DO NOT SET. Leave unset and rely on trustHost so Auth.js uses
#               the real per-deploy request host. Pinning these to a fixed
#               domain (e.g. the production URL) breaks OAuth on per-commit
#               preview URLs AND breaks demo login (the cookie salt/host stops
#               matching the request), bouncing users to /login.
#   Production: set BOTH to your HTTPS deployment URL, or omit and rely on
#               trustHost. Auth.js uses AUTH_URL to pick the session cookie
#               name/salt, so a mismatch breaks demo login.
AUTH_URL=http://localhost:3000
NEXTAUTH_URL=http://localhost:3000

# OAuth providers (configure at least one for production sign-in).
# Local development does NOT use OAuth — sign in with the dev-credentials
# provider (DEV_AUTH_* below). Leave these unset locally so the login page
# shows the buttons as "not configured" instead of failing on click.
# Previews also skip OAuth (use the demo sandbox to review PRs).
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Font Awesome Pro kit (required for npm install on Vercel/CI)
FONTAWESOME_NPM_AUTH_TOKEN=

# Resume uploads (optional — required for /api/resume/upload)
# IMPORTANT: resumes contain PII and are stored in a PRIVATE Vercel Blob store.
# Create a private Blob store in the Vercel dashboard and use its token here.
# Files are uploaded directly from the browser and served via short-lived
# signed URLs; they are never publicly accessible.
BLOB_READ_WRITE_TOKEN=
BLOB_STORE_ID=

# Local development only (dev-credentials provider is disabled in production)
DEV_AUTH_EMAIL=dev@example.com
DEV_AUTH_PASSWORD=password
DEV_AUTH_NAME=Dev User

# Interview Prep (optional — set INTERVIEW_PREP_ENABLED=true to enable)
INTERVIEW_PREP_ENABLED=false
OPENAI_API_KEY=
TAVILY_API_KEY=