# intervalsicu-mcp-auth — environment (copy to .env; do not commit real secrets)

# Public base URL of this auth server. The OAuth/OIDC issuer is <this>/api/auth.
BETTER_AUTH_URL=https://intervalsicu.farhoodlabs.com
# Better Auth signing secret — generate a long random string.
BETTER_AUTH_SECRET=
# Postgres connection string (the shared CNPG database).
AUTH_DATABASE_URL=postgres://user:password@host:5432/dbname

# Google social login credentials.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Optional Apple sign-in (added only if all three are set).
# APPLE_CLIENT_ID=
# APPLE_CLIENT_SECRET=
# APPLE_APP_BUNDLE_IDENTIFIER=

# Comma-separated allowed token audiences / RFC 8707 resources — must include the
# MCP server's /mcp URL so issued access tokens carry the right aud.
VALID_AUDIENCES=https://intervalsicu.farhoodlabs.com/mcp
# Comma-separated trusted origins for Better Auth.
TRUSTED_ORIGINS=https://intervalsicu.farhoodlabs.com

# Comma-separated hostnames allowed as DCR client redirect_uri hosts. When unset,
# defaults to claude.ai, claude.com and the BETTER_AUTH_URL host (the portal).
# This is a security control: it blocks attacker-registered clients from pointing
# authorization codes at their own domain. Set only to override the defaults.
# ALLOWED_REDIRECT_HOSTS=claude.ai,claude.com,intervalsicu.farhoodlabs.com

# Logger level: debug | info (default info).
LOG_LEVEL=info
# HTTP listen port (default 8080).
PORT=8080

# Portal OIDC client seeded by migrate.ts (both have defaults; override if needed).
# PORTAL_CLIENT_ID=
# PORTAL_REDIRECT_URI=