.env.example

# =============================================================================
# Biome server environment variables
# Copy to .env and fill in values. Every var below is referenced via
# process.env in server/ (excluding test files).
# =============================================================================

# -----------------------------------------------------------------------------
# Core server
# -----------------------------------------------------------------------------

# HTTP port for the Express server. Optional; defaults to 3000.
PORT=3000

# Runtime mode. Optional; defaults to development behavior when unset.
# Set to "production" to enable secure cookies, hide dev OTP codes, and require
# configured email/SMS senders for OTP routes.
NODE_ENV=development

# Comma-separated list of allowed browser origins for CORS (with credentials).
# Optional; defaults to http://localhost:3001.
CORS_ORIGIN=http://localhost:3001

# -----------------------------------------------------------------------------
# Authentication
# -----------------------------------------------------------------------------

# Secret used to sign and verify JWT session tokens (auth middleware + routes).
# Optional; defaults to dev_jwt_secret_change_me. Set a strong value in production.
JWT_SECRET=dev_jwt_secret_change_me

# Public URL of the frontend app, used for OAuth redirects and post-login links.
# Optional; falls back to the incoming request host when unset.
FRONTEND_URL=http://localhost:3001

# Google OAuth client ID. Optional; required only when Google sign-in is enabled.
GOOGLE_CLIENT_ID=

# Google OAuth client secret. Optional; required only when Google sign-in is enabled.
GOOGLE_CLIENT_SECRET=

# Override for the Google OAuth callback URL registered in Google Cloud Console.
# Optional; defaults to {request-host}/auth/google/callback when unset.
GOOGLE_REDIRECT_URI=

# -----------------------------------------------------------------------------
# Database
# -----------------------------------------------------------------------------

# MongoDB connection URI. Optional; when set, repositories and OTP store use MongoDB
# instead of in-memory/SQLite fallbacks.
MONGODB_URI=

# MongoDB database name. Optional; defaults to deepenk.
MONGODB_DB_NAME=deepenk

# -----------------------------------------------------------------------------
# Rate limiting
# -----------------------------------------------------------------------------

# Rate-limit window in milliseconds. Optional; defaults to 60000 (1 minute).
RATE_LIMIT_WINDOW_MS=60000

# Maximum requests per IP per window. Optional; defaults to 120.
RATE_LIMIT_MAX=120

# -----------------------------------------------------------------------------
# Payments (Node proxy to payments-hs)
# -----------------------------------------------------------------------------

# Base URL of the Haskell payments service. Optional; defaults to http://localhost:4010.
PAYMENTS_SERVICE_URL=http://localhost:4010

# Enable background polling that syncs order status from payment intents. Optional; defaults to true.
ORDER_PAYMENTS_SYNC_ENABLED=true

# Interval between sync ticks in milliseconds. Optional; defaults to 30000 (min 10000).
ORDER_PAYMENTS_SYNC_INTERVAL_MS=30000

# Max orders checked per sync tick. Optional; defaults to 50 (clamped 1–200).
ORDER_PAYMENTS_SYNC_LIMIT=50

# -----------------------------------------------------------------------------
# OTP delivery (required in production when using email/SMS login)
# -----------------------------------------------------------------------------

# SendGrid API key for email OTP. Optional in dev; required in production for email OTP.
SENDGRID_API_KEY=

# Verified sender address for SendGrid email OTP. Optional in dev; required with SENDGRID_API_KEY in production.
SENDGRID_FROM=

# Twilio account SID for SMS OTP. Optional in dev; required in production for phone OTP.
TWILIO_ACCOUNT_SID=

# Twilio auth token for SMS OTP. Optional in dev; required in production for phone OTP.
TWILIO_AUTH_TOKEN=

# Twilio sender phone number for SMS OTP. Optional in dev; required in production for phone OTP.
TWILIO_FROM=

# -----------------------------------------------------------------------------
# LLM / AI
# -----------------------------------------------------------------------------

# Google Gemini API key (checked first). Optional; if unset, other LLM vars or a stub client is used.
GEMINI_API_KEY=

# Alternate env names accepted for the Gemini API key. Optional.
GOOGLE_AI_API_KEY=
GOOGLE_API_KEY=

# Gemini model name. Optional; defaults to gemini-1.5-flash.
GEMINI_MODEL=gemini-1.5-flash

# OpenAI-compatible LLM fallback (all three required together to use this provider).
LLM_API_KEY=
LLM_BASE_URL=
LLM_MODEL=

# -----------------------------------------------------------------------------
# RapidAPI (food, ecommerce, rides integrations)
# -----------------------------------------------------------------------------

# Shared RapidAPI subscription key sent as x-rapidapi-key on every provider request.
# Optional. Checked in order: RAPIDAPI_KEY first, then RAPID_API_KEY as an alias.
# When unset (or when a provider's HOST/URL vars are missing), productService returns
# empty provider results instead of synthetic mock data.
RAPIDAPI_KEY=
RAPID_API_KEY=

# -----------------------------------------------------------------------------
# RapidAPI — ecommerce (productService.ts)
# -----------------------------------------------------------------------------
# Used only for providers "Amazon", "Flipkart", and "Myntra" in searchAcrossProviders.
# Provider string → env key: uppercased, non-alphanumeric → "_" (e.g. "Amazon" → AMAZON).
# eBay in the same file uses EBAY_* vars below, not RapidAPI.
#
# The repo does not pin a specific RapidAPI marketplace listing for any provider.
# Subscribe to any compatible API on rapidapi.com, then copy its x-rapidapi-host value
# and endpoint paths into the vars below.
#
# SEARCH_URL: full URL; may embed {query} or omit it (code appends ?query=).
# DETAILS_URL: full URL; may embed {id} or omit it (code appends ?id=).

# Amazon ("Amazon" → AMAZON). Marketplace listing: not specified in repo.
# RAPIDAPI_AMAZON_HOST=
# RAPIDAPI_AMAZON_SEARCH_URL=
# RAPIDAPI_AMAZON_DETAILS_URL=

# Flipkart ("Flipkart" → FLIPKART). Marketplace listing: not specified in repo.
# RAPIDAPI_FLIPKART_HOST=
# RAPIDAPI_FLIPKART_SEARCH_URL=
# RAPIDAPI_FLIPKART_DETAILS_URL=

# Myntra ("Myntra" → MYNTRA). Marketplace listing: not specified in repo.
# RAPIDAPI_MYNTRA_HOST=
# RAPIDAPI_MYNTRA_SEARCH_URL=
# RAPIDAPI_MYNTRA_DETAILS_URL=

# -----------------------------------------------------------------------------
# RapidAPI — food and rides (foodService.ts, ridesService.ts)
# -----------------------------------------------------------------------------
# Same key derivation as above. Food uses _HOST, _SEARCH_URL, _MENU_URL; rides uses
# _HOST and _FARE_URL. Marketplace listings not specified in repo.

# Swiggy ("Swiggy" → SWIGGY):
# RAPIDAPI_SWIGGY_HOST=
# RAPIDAPI_SWIGGY_SEARCH_URL=
# RAPIDAPI_SWIGGY_MENU_URL=

# Uber ("Uber" → UBER):
# RAPIDAPI_UBER_HOST=
# RAPIDAPI_UBER_FARE_URL=

# -----------------------------------------------------------------------------
# eBay product search
# -----------------------------------------------------------------------------

# eBay OAuth client ID. Optional; eBay provider is skipped when unset.
EBAY_CLIENT_ID=

# eBay OAuth client secret. Optional; required with EBAY_CLIENT_ID for eBay search.
EBAY_CLIENT_SECRET=

# eBay API environment. Optional; defaults to production (use "sandbox" for testing).
EBAY_ENV=production

# eBay marketplace ID. Optional; defaults to EBAY_IN.
EBAY_MARKETPLACE_ID=EBAY_IN

# eBay OAuth scope. Optional; defaults to https://api.ebay.com/oauth/api_scope.
EBAY_OAUTH_SCOPE=https://api.ebay.com/oauth/api_scope