secrets.env.example

# Copy to secrets.env, fill in real values, and never commit that file.

# The host-only bearer token for the admin API. A random string of at least 32 characters.
ADMIN_TOKEN=replace-with-a-random-token-at-least-32-chars

# Better Auth's signing secret. A random string.
BETTER_AUTH_SECRET=replace-with-a-random-secret

# The address the magic links come from. Its domain must be onboarded in Cloudflare Email Service.
EMAIL_FROM=sign-in@example.com

# The public host suffix, with the leading dot. Leave unset for `.localhost` on the local platform's port.
# With a real suffix the scripts talk to https://api<suffix> and sign-in lives at https://auth<suffix>.
APPLET_HOST_SUFFIX=.example.com

# The email that is always allowed to sign in, even before it is in allowed_users.
OWNER_EMAIL=replace-with-your-email@example.com

# The OpenRouter key behind `@std`'s `ai`. Only the router holds it; set a credit limit on it.
OPENROUTER_API_KEY=replace-with-an-openrouter-key