.env.example

# Copy this file to .env and fill in your own Supabase project's values.
# Find both on your Supabase project's dashboard under Settings > API.
# VITE_SUPABASE_ANON_KEY is the "anon" / "publishable" key - safe to ship
# in client-side code (that's what it's for). Never put a service-role
# key in this file or anywhere else in this app.

VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-public-key

# Phase 31 - Payments. PayMongo test-mode credentials - find both on your
# PayMongo dashboard under Developers > API Keys. Switch both to your
# *live* keys (pk_live_.../sk_live_...) only when you're ready to accept
# real payments in production; everything below is wired for test mode.
#
# VITE_PAYMONGO_PUBLIC_KEY (pk_test_...) is safe to ship in client-side
# code - same idea as VITE_SUPABASE_ANON_KEY above - and is the only
# PayMongo credential the browser ever sees. It's used to tokenize card
# details directly against PayMongo's API (see src/lib/payments/paymongo.ts),
# so raw card numbers never pass through this app's own server.
VITE_PAYMONGO_PUBLIC_KEY=pk_test_your_public_key

# PAYMONGO_SECRET_KEY (sk_test_...) is NOT prefixed with VITE_ on purpose -
# that prefix is what tells Vite to bundle a variable into client code, and
# this one must never end up there. It's read only by the serverless
# functions in api/paymongo/ (creating and confirming payments), which run
# on the server, never in the browser.
PAYMONGO_SECRET_KEY=sk_test_your_secret_key

# Phase 33 - Notifications. Resend credentials for order-confirmation
# emails - find your API key on the Resend dashboard under API Keys.
# Neither variable is VITE_-prefixed: an email send has no client-safe
# half at all (unlike PayMongo's public/secret key split above), so both
# are read only by the serverless function in api/resend/, never bundled
# into client code. See src/lib/notifications/email.ts for how the
# browser reaches this without ever touching Resend or this key itself.
RESEND_API_KEY=re_your_api_key

# The "from" address Resend sends as - must be on a domain you've
# verified with Resend. Defaults to their shared onboarding@resend.dev
# sender (fine for testing, but Resend rate-limits and may flag it) if
# left unset - see resendFromAddress() in api/resend/_shared.ts.
RESEND_FROM_EMAIL=orders@your-verified-domain.com