.env.example

# Bayan Flow — copy to .env.local for local development (never commit secrets)

# Supabase (Google OIDC auth) — publishable anon key only
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-key

# Google Identity Services — Web OAuth client ID (public)
VITE_GOOGLE_WEB_CLIENT_ID=your-web-client-id.apps.googleusercontent.com

# Cloudflare Turnstile (signup bot gate) — public site key only
# Matching secret key goes in Supabase Dashboard → Authentication → CAPTCHA
# protection (Turnstile), NOT in a VITE_* var. Client sends it via captchaToken.
VITE_TURNSTILE_SITE_KEY=0x4AAAAA...your-turnstile-site-key

# PostHog analytics (optional — skip in local dev)
VITE_POSTHOG_API_HOST=https://us.i.posthog.com
VITE_POSTHOG_API_KEY=phc_your_project_token
# For production with reverse proxy: VITE_POSTHOG_API_HOST=https://e.bayanflow.com

# Optional: Pyodide CDN override (see src/constants/pyodideCdn.js)
# VITE_PYODIDE_CDN_BASE=