.env.example

# API Configuration
# In production, secrets should be sourced from AWS Secrets Manager
SECRETS_MANAGER_ENABLED=false  # Set to true in production
AWS_REGION=us-east-1

# Required secrets (in production, inject via AWS Secrets Manager):
#   - swiftremit/DATABASE_URL
#   - swiftremit/JWT_SECRET
PORT=3000
NODE_ENV=development
DATABASE_URL=postgres://postgres:postgres@localhost:5432/swiftremit

# CORS Allowlist
# Comma-separated list of exact origins allowed to call this API cross-origin
# (e.g. the SwiftRemit frontend). Origins not on this list are rejected;
# credentials (cookies) are only sent for allowlisted origins — required for
# the cookie-based /api/auth/refresh flow (see AUTH_MATRIX.md).
ALLOWED_ORIGINS=https://app.swiftremit.io,http://localhost:5173
CONTRACT_RPC_URL=
ANCHORS_ADMIN_API_KEY=change-me

# Rate Limiting
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=100

# Currency Configuration
CURRENCY_CONFIG_PATH=./config/currencies.json
CURRENCY_CONFIG_ENV_OVERRIDE=false

# Environment-specific currency overrides (JSON format)
# Example: CURRENCY_OVERRIDES='[{"code":"USD","symbol":"$","decimal_precision":2}]'
CURRENCY_OVERRIDES=

# ── OpenTelemetry / Distributed Tracing (SR-108) ─────────────────────────────
OTEL_ENABLED=true
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
JAEGER_ENDPOINT=http://localhost:4318
OTEL_SERVICE_NAME=swiftremit-api
# Sampler: always_on | always_off | traceidratio | parentbased_traceidratio
OTEL_TRACES_SAMPLER=parentbased_traceidratio
# 0.1 = 10% in production; set to 1.0 for full sampling in development
OTEL_TRACES_SAMPLER_ARG=0.1