.env.production.example

# Production server environment. Do not commit real secrets.

NODE_ENV=production

# Neon pooled PostgreSQL connection string. Set this in Render environment vars.
DATABASE_URL=postgres://USER:PASSWORD@HOST:PORT/DATABASE

# Required in production. Use a long random value generated outside this repo.
AUTH_JWT_SECRET=replace-with-a-long-random-production-secret
# Required in production. Separate from AUTH_JWT_SECRET; used to HMAC refresh tokens at rest.
AUTH_REFRESH_TOKEN_HASH_SECRET=replace-with-another-long-random-production-secret
AUTH_JWT_ISSUER=darksaber-world
AUTH_JWT_AUDIENCE=darksaber-client
AUTH_ACCESS_TOKEN_TTL_SECONDS=900

# The production client origins allowed to call auth HTTP APIs and open WebSockets.
AUTH_ALLOWED_ORIGINS=https://your-client-domain.example.com

# Vercel + Render are cross-site, so use None with Secure cookies enabled.
AUTH_REFRESH_COOKIE_SAMESITE=None

# Keep at 1 until raid/party IDs become the session shard key.
WORLD_SHARD_COUNT=1

# Vercel client build environment
VITE_AUTH_SERVER_URL=https://your-world-server.example.com
VITE_WORLD_SERVER_URL=wss://your-world-server.example.com