.env.example

DYNAMODB_TABLE=reference-architecture
TENANT_RESOLUTION_MODE=subdomain
# One auth provider per deployment: none, internal_magic_link, or oidc
AUTH_PROVIDER=internal_magic_link
# Required when TENANT_RESOLUTION_MODE=fixed
# Fixed tenant id is the logical TENANT# key prefix; use a deployment-specific
# DynamoDB table for physical product/environment isolation.
APP_TENANT_ID=reference-architecture-local
# Generate with: openssl rand -hex 32
COOKIE_SECRET=
# Set to 'noop' locally to skip email sending, 'redirect' to forward all emails to RESEND_REDIRECT_EMAIL
EMAIL_MODE=noop
# Generate at: https://resend.com/api-keys (not required when EMAIL_MODE=noop)
RESEND_API_KEY=
RESEND_FROM_EMAIL=noreply@email.com
# Required only when AUTH_PROVIDER=oidc
OIDC_ISSUER=
OIDC_AUDIENCE=
# Optional; defaults to <OIDC_ISSUER>/.well-known/jwks.json
OIDC_JWKS_URI=
# Public Auth0 SPA application client id. Surfaced to the browser via
# GET /api/config so the frontend can run the Auth0 login flow when
# AUTH_PROVIDER=oidc. Public value (safe to expose), not a secret. Use the
# Auth0 SPA application client id — never the M2M client id or any client
# secret. Leave blank to deploy the OIDC backend without the frontend login UI.
AUTH0_SPA_CLIENT_ID=