NEXT_PUBLIC_API_URL=https://your-backend.railway.app
NEXT_PUBLIC_API_KEY=your-secure-api-key-here

NODE_ENV=production
API_KEY=your-secure-api-key-here
ALLOWED_ORIGINS=https://your-app.vercel.app,https://your-custom-domain.com

# Database credentials
NEO4J_URI=neo4j+s://xxx.databases.neo4j.io
NEO4J_USER=neo4j
NEO4J_PASSWORD=xxx
QDRANT_ENDPOINT=https://xxx.qdrant.io
QDRANT_KEY=xxx
MISTRAL_API_KEY=xxx

• Backend only accepts requests from allowed origins
• Set ALLOWED_ORIGINS in Railway to your Vercel URL

• Required in production (NODE_ENV=production)
• Frontend sends key via x-api-key header
• Backend validates on protected endpoints

# Generate a secure random key
openssl rand -base64 32

Or use: uuidgen or any password generator

• /api/search - Requires API key in production
• /api/init-neo4j - Requires API key in production
• /health - Public (for monitoring)
• /api/connections - Public (for debugging)

• Generate unique API_KEY
• Set same API_KEY in both Railway and Vercel
• Set ALLOWED_ORIGINS to your Vercel domain
• Set NODE_ENV=production in Railway
• Use HTTPS URLs only
• Don't commit .env files
• Rotate API keys periodically

1. Generate API Key:

openssl rand -base64 32
# Output: Kj3n4mP9xQ2wL8vT6yR5sA1bC7dE0fG9hI4jK2lM3nO=

2. Railway Variables:

NODE_ENV=production
API_KEY=Kj3n4mP9xQ2wL8vT6yR5sA1bC7dE0fG9hI4jK2lM3nO=
ALLOWED_ORIGINS=https://terrain-explorer.vercel.app

3. Vercel Variables:

NEXT_PUBLIC_API_URL=https://terrain-backend.railway.app
NEXT_PUBLIC_API_KEY=Kj3n4mP9xQ2wL8vT6yR5sA1bC7dE0fG9hI4jK2lM3nO=

# Should fail (no API key)
curl -X POST https://your-backend.railway.app/api/search \
  -H "Content-Type: application/json" \
  -d '{"query":"test"}'

# Should succeed (with API key)
curl -X POST https://your-backend.railway.app/api/search \
  -H "Content-Type: application/json" \
  -H "x-api-key: your-api-key" \
  -d '{"query":"test"}'