.env.example

# ====================================================================
# Cloudflare Fullstack Starter environment example
# ====================================================================
#
# Copy this file to one of:
# - .env.local
# - .env.preview
# - .env.production
#
# Environment-specific templates also live in env/*.env.template.
#
# Values in .env.* are gitignored. Preview/production secrets are synced to
# Cloudflare by the deploy scripts. Non-secret Worker vars and bindings live
# in wrangler.toml.

# Environment name: local, preview, or production. This is also defined in
# wrangler.toml and is included here for CLI/template parity.
ENVIRONMENT=local

# Email provider: cloudflare or resend. Cloudflare uses the SEND_EMAIL binding
# from wrangler.toml. Resend requires EMAIL_PROVIDER=resend and EMAIL_API_KEY.
EMAIL_PROVIDER=cloudflare
EMAIL_API_KEY=

# Force Better Auth verification/reset emails in local development. With
# Cloudflare, the local SEND_EMAIL binding uses remote=true, so local auth
# emails are delivered when this is enabled.
AUTH_EMAILS_LOCAL_ENABLED=false

# Public base URL used by Better Auth for sessions, OAuth, verification, and
# password-reset links. Defaults are:
# - local: http://localhost:5173
# - preview: https://preview.example.com
# - production: https://app.example.com
APP_BASE_URL=http://localhost:5173

# Optional Google OAuth credentials. Used only when Google auth is enabled in
# src/config.ts.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Shared secret for the management CLI (`npm run auth ...`). This must be set
# in the Worker environment and in the matching .env.<environment> file used by
# the CLI.
# Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
CLI_API_KEY=

# CLI API URL overrides. Local defaults to http://localhost:5173 when empty.
CLI_API_URL=http://localhost:5173
CLI_API_URL_PREVIEW=https://preview.example.com
CLI_API_URL_PRODUCTION=https://app.example.com