.env.example

# Use sslmode=verify-full to avoid the pg v9 deprecation warning for legacy
# aliases (require/prefer/verify-ca). Neon requires SSL; verify-full is the
# correct long-term form.
DATABASE_URL=postgresql://user:password@host/dbname?sslmode=verify-full
DIRECT_URL=postgresql://user:password@host/dbname?sslmode=verify-full

# Signs session cookies — must be at least 32 characters: openssl rand -base64 32
BETTER_AUTH_SECRET=

# Only set in production, pinned to the real domain. Preview and local fall back to
# VERCEL_URL, then http://localhost:3000, since VERCEL_URL changes per deployment.
BETTER_AUTH_URL=

# Resend transactional email — Better Auth calls sendEmail() directly for OTPs.
RESEND_API_KEY=
RESEND_FROM_EMAIL=

# Signing secret for the Resend webhook's endpoint (Resend dashboard → the webhook).
RESEND_WEBHOOK_SECRET=

# Dev-bypass login (see lib/utils.ts#isBypassAllowed) is disabled by default
# on any host, including production deployments not on Vercel. This repo's
# `dev` script is plain `next dev --turbopack` (no Vercel CLI), so VERCEL_ENV
# is not set automatically for local development — set this explicitly in
# your local .env or the bypass login form will be a no-op.
VERCEL_ENV=development

# Vercel Blob (private store) — backs file_upload question answers.
# Create a Blob store from the Vercel dashboard (Storage → Create Database →
# Blob → Private) and connect it to this project; Vercel then auto-injects
# BLOB_READ_WRITE_TOKEN (and BLOB_STORE_ID) for all environments. File uploads
# throw a generic error locally until this is set.
BLOB_READ_WRITE_TOKEN=
BLOB_STORE_ID=