.env.example

# Public (embedded in Vite client — safe to expose)
VITE_STRAVA_CLIENT_ID=
VITE_SUPPORT_EMAIL=you@yourdomain.com
# Must match Strava "Authorization Callback Domain" + your production hostname (one canonical URL)
VITE_APP_ORIGIN=https://iraceapp.vercel.app

# Server-only (Vercel / Node — never commit real values)
STRAVA_CLIENT_ID=
STRAVA_CLIENT_SECRET=
# Required: signs 15-minute access JWTs and hashes refresh / exchange tokens (min ~16 chars, random)
AUTH_SESSION_SECRET=

# Strava push subscriptions (webhooks) — must match scripts/register-strava-webhook.mjs and Vercel Production
STRAVA_WEBHOOK_VERIFY_TOKEN=
DATABASE_URL=
# Neon / Vercel: pooled + direct (migrations). Local Docker: set both to the same connection string.
DATABASE_URL_UNPOOLED=
FRONTEND_URL=https://iraceapp.vercel.app
# Optional: comma-separated origins for CORS (overrides single FRONTEND_URL when set)
# ALLOWED_ORIGINS=https://iraceapp.vercel.app,http://localhost:5173
# Vercel Preview: add each preview app URL here if the preview frontend calls this API cross-origin
# (e.g. https://irace-git-feature-username.vercel.app).
# Server-only: required for POST /api/user (legacy upsert + session mint; OAuth callback does not use this route)
INTERNAL_USER_UPSERT_SECRET=

# Optional: require TLS to Postgres
# DATABASE_SSL=true

# Last resort only (local broken CA / proxy). Disables TLS verification for all Node HTTPS.
# Never set true in production.
# ALLOW_INSECURE_TLS=true

# --- Web Push (optional; does not change Strava scopes) ---
# Generate: npm run generate-vapid
# Server (Vercel / Node — private key never in the client bundle)
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
# VAPID "subject" claim — use a mailto: or https: URL you control
VAPID_SUBJECT=mailto:you@yourdomain.com
# Client (Vite — public key only; must match VAPID_PUBLIC_KEY)
VITE_VAPID_PUBLIC_KEY=