.env.example

# Run `pnpm dev:setup` to create the permission-restricted .env.local file. These
# neutral placeholders document the contract; do not hand-edit pooler URLs when
# the wizard can assemble and validate them for you.

# Supabase session pooler only: *.pooler.supabase.com, port 5432, /postgres,
# and the role-qualified username <role>.<project-ref>. A free dedicated
# Supabase project is sufficient. Administrative credentials stay in
# .env.migrate and never enter the application environment.
SUPABASE_GATEWAY_DATABASE_URL=postgresql://app_gateway.<project-ref>:<generated-role-password>@<region-pooler-host>.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
SUPABASE_AGENT_DATABASE_URL=postgresql://app_agent.<project-ref>:<generated-role-password>@<region-pooler-host>.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
SUPABASE_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks.<project-ref>:<generated-role-password>@<region-pooler-host>.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true

# Clerk development instance. Production keys are rejected locally. Configure
# the Clerk session token to expose metadata={{user.public_metadata}}.
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_<clerk-publishable-key>
CLERK_SECRET_KEY=sk_test_<clerk-secret-key>
CLERK_WEBHOOK_SIGNING_SECRET=
NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787

# Daytona development access. DAYTONA_SANDBOX_SNAPSHOT is an immutable snapshot
# built from infra/containers/sandbox. The webhook secret is required; unlike
# optional provider groups, it may not stay empty.
DAYTONA_API_KEY=<daytona-api-key>
DAYTONA_API_URL=https://app.daytona.io/api
DAYTONA_PREVIEW_HOST_SUFFIXES=daytonaproxy01.net,proxy.daytona.work
DAYTONA_SANDBOX_SNAPSHOT=<immutable-snapshot-name>
DAYTONA_TARGET=us
DAYTONA_WORKSPACE_VOLUME=cheatcode-workspaces-development
DAYTONA_WEBHOOK_SIGNING_SECRET=<daytona-webhook-signing-secret>
DAYTONA_ORG_ID=

# Optional integrations. Skipping Composio disables connected apps; skipping
# DeepSeek means users rely on BYOK for that provider.
COMPOSIO_API_KEY=
COMPOSIO_AUTH_CONFIGS=
COMPOSIO_WEBHOOK_SECRET=
DEEPSEEK_PLATFORM_API_KEY=

# Optional Polar sandbox billing. Skipping this group disables local checkout
# and billing webhooks while core agent flows remain available.
POLAR_ACCESS_TOKEN=
POLAR_SERVER=sandbox
POLAR_WEBHOOK_SECRET=
POLAR_PRODUCT_ID_PRO=
POLAR_PRODUCT_ID_PREMIUM=

# Generated by `pnpm dev:setup`; each value is at least 32 bytes. Values within the
# two documented distinctness groups are never reused.
DATABASE_CONTEXT_SIGNING_SECRET_AGENT=<generated-by-pnpm-dev-setup>
DATABASE_CONTEXT_SIGNING_SECRET_GATEWAY=<generated-by-pnpm-dev-setup>
DATABASE_CONTEXT_SIGNING_SECRET_WEBHOOKS=<generated-by-pnpm-dev-setup>
PREVIEW_TOKEN_SECRET=<generated-by-pnpm-dev-setup>
OUTPUT_DOWNLOAD_SIGNING_SECRET=<generated-by-pnpm-dev-setup>