NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
NEXT_PUBLIC_APP_URL=https://your-domain.com
CRON_SECRET=generate-a-random-secret

# Self-hosted (Docker) flag: disables application-side MFA enforcement.
NEXT_PUBLIC_SELF_HOSTED=true

# Session timeouts are also disabled by default for self-hosted deployments.
# Uncomment to opt into hosted-style banking-app limits (milliseconds).
# NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
# NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
# NEXT_PUBLIC_SESSION_WARNING_MS=120000
# Optional dedicated HMAC secret; otherwise SUPABASE_SERVICE_ROLE_KEY is used.
# SESSION_TIMEOUT_SECRET=

# Set to true when public signup is turned off in your GoTrue/Supabase auth
# config (GOTRUE_DISABLE_SIGNUP / "Allow new users to sign up" off). GoTrue
# offers no clean server-side read of that setting, so this flag mirrors it.
# When true, inviting a teammate who has no account provisions the account
# server-side via the auth admin invite API (GoTrue must have SMTP configured
# to deliver that mail) instead of relying on public /register, which GoTrue
# would reject with "Signups not allowed".
# The GoTrue redirect URI allow-list (URI Allow List / GOTRUE_URI_ALLOW_LIST)
# must include /invite/* or the invite email's redirect silently falls back
# to SITE_URL.
# AUTH_SIGNUPS_DISABLED=false

# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
# (http:// by ws://). Set only if Realtime is served from another origin.
# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co