.dev.vars.example

# Local Worker vars for `wrangler dev`
# Copy to `.dev.vars` and fill in real values.

# Optional: GraphiQL in browser for local debugging
ENABLE_GRAPHIQL=true

# Optional: admin bypass for trusted server-to-server calls
# ADMIN_SECRET=replace-with-a-strong-random-secret

# JWT auth config: choose ONE mode

# Mode A: HS256 shared secret
JWT_SECRET=replace-with-a-long-random-hs256-secret

# Mode B: RS256 via JWKS (uncomment both lines, and remove JWT_SECRET)
# JWT_JWKS_URL=https://auth.example.com/.well-known/jwks.json

# Required for either JWT mode
JWT_ISSUER=https://auth.example.com/
JWT_AUDIENCE=durable-graphql
JWT_CLOCK_SKEW_SECONDS=30

# Optional claims mapping (defaults shown)
# JWT_CLAIMS_NAMESPACE=https://myapp.com/claims
# JWT_CLAIMS_ROLE_KEY=role
# JWT_CLAIMS_DEFAULT_ROLE_KEY=default-role
# JWT_CLAIMS_USER_ID_KEY=user-id