.env.example

# ============================================================
# RenAIssance — environment template. Copy to `.env` and fill in.
# `.env` is gitignored; never commit real secrets.
# ============================================================

# --- AI / OCR provider keys (passed per-request to providers) ---
GEMINI_API_KEY=
OPENAI_API_KEY=
DEEPSEEK_API_KEY=
QWEN_API_KEY=

# HuggingFace token for the "Local fine-tuned (Spanish)" corrector. Its base
# model (google/gemma-3-4b-it) is GATED, so the first-use download needs a
# token whose HF account has accepted the licence at
# huggingface.co/google/gemma-3-4b-it. Only needed if you use that provider.
HF_TOKEN=

# ============================================================
# User tracking / auth  (BACKEND-ONLY — never exposed to the browser)
# ============================================================

# Local auth store (per instance). Leave UNSET to use SQLite on the storage
# volume (the default; works offline). Advanced: set a postgresql:// URL to use
# your own Postgres for local accounts.
# DATABASE_URL=

# Signs session cookies. Generate with:
#   python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=

# Bearer token for GET /api/admin/users (this instance's local users).
# Leave blank to DISABLE the admin endpoint (returns 404).
ADMIN_TOKEN=

# Deployed origin. Only effect: session cookies get the Secure flag on https.
PUBLIC_BASE_URL=http://localhost:5173

# --- Central tracking (Supabase REST + PUBLISHABLE key) ---
# Safe to be public: the central `users` table has an INSERT-only RLS policy,
# so this key can only add a signup row. Published images bake these in via the
# Dockerfile; set them here for local/dev runs. NEVER put the Postgres password
# or the service_role/secret key here.
SUPABASE_URL=
SUPABASE_PUBLISHABLE_KEY=