.env.example

# Copy to `.env` and fill in your secrets.
#
# For local dev, ports/URLs/Supabase keys/Redis/Inngest are auto-generated into
# `.env.local` by `crbn up` (see packages/dev/src/commands/up.ts). Vite/React Router
# auto-load `.env.local` on top of `.env`, so you only need to set genuine
# secrets in this file (OAuth, Stripe, Resend, etc.). Leave port/URL/Supabase
# variables out — `.env.local` will provide them.

# Carbon
AUTH_PROVIDERS="email,google,passkey" # "email" | "google" | "azure" | "passkey"
CARBON_EDITION="community" # "community" | "cloud" | "enterprise"
SESSION_SECRET="************************"
RATE_LIMIT="10"
# MAINTENANCE_MODE="true" # every request except /health answers 503 with a maintenance screen; needs a restart
# SYSTEM_STATUS_URL="https://example.com/status.json" # optional; { latestVersion?, announcement? } shown as a bar in the app
# Feature flags — optional; unset means every flag answers its registry default (packages/env/src/flags.ts).
# CARBON_FLAGS_ENDPOINT="https://console.carbon.ms/api/flags" # https: polls; data: loads once
# CARBON_FLAGS_HEADERS="Authorization=Bearer%20<token>" # k=v pairs separated by commas, percent-encoded (the OTEL headers format)
# CARBON_COMMIT_SHA="<git sha>" # optional; sent to the flags source as X-Carbon-Commit (Vercel sets it automatically)
# LOG_LEVEL="debug" # trace|debug|info|warning|error|fatal — optional; default dev=debug, prod=info, browser prod=warning
# Server tracing (OpenTelemetry) — optional; off unless an OTLP endpoint is set. Any OTLP backend works; Axiom shown.
# OTEL_EXPORTER_OTLP_ENDPOINT="https://api.axiom.co"
# OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer%20<api-token>,X-Axiom-Dataset=<dataset>"
# OTEL_RESOURCE_ATTRIBUTES="deployment.environment.name=production"
# OTEL_TRACES_SAMPLER="parentbased_traceidratio"
# OTEL_TRACES_SAMPLER_ARG="0.1"

# Supabase OAuth (client IDs/secrets from your provider; redirect URIs come from .env.local)
SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID="************.apps.googleusercontent.com"
SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET="GOCSPX-****************************"
SUPABASE_AUTH_EXTERNAL_AZURE_CLIENT_ID="***************************************"
SUPABASE_AUTH_EXTERNAL_AZURE_CLIENT_SECRET="***********************************"

# Posthog
POSTHOG_API_HOST="https://us.posthog.com"
POSTHOG_PROJECT_PUBLIC_KEY="********************"

# Stripe
STRIPE_SECRET_KEY="sk_test_*************"
STRIPE_WEBHOOK_SECRET="whsec_************"
STRIPE_CONNECT_WEBHOOK_SECRET="whsec_************"

# GTM (notifications fan-out)
GTM_EVENTS_API_SECRET_KEY=""

# SMTP (email transport; leave unset to disable email)
# Port 465 = implicit TLS, 587 = STARTTLS
SMTP_HOST=""
SMTP_PORT="587"
SMTP_USER=""
SMTP_PASSWORD="************************"
SMTP_FROM="Carbon <no-reply@carbon.ms>"

# Resend (marketing contacts only — optional; also a legacy SMTP fallback when SMTP_* is unset)
# RESEND_API_KEY="************************"
# RESEND_AUDIENCE_ID="*****" # Optional — required for contact management in `packages/jobs`

# Inngest (production keys; dev mode flags are in .env.local)
# INNGEST_SIGNING_KEY="signkey-****-********************"
# INNGEST_EVENT_KEY="********************"

# Cloudflare Turnstile — the login bot check off Vercel (on Vercel, BotID runs
# instead). Both keys or neither. The pair below is Cloudflare's always-pass
# test pair, for exercising the widget locally.
# CLOUDFLARE_TURNSTILE_SITE_KEY="1x00000000000000000000AA"
# CLOUDFLARE_TURNSTILE_SECRET_KEY="1x0000000000000000000000000000000AA"
# Which check guards login: "botid" (Vercel only) or "turnstile". Unset picks
# BotID for Cloud on Vercel, else Turnstile when the keys above are set.
# BOT_PROTECTION="turnstile"

# Integrations. Every one of these is OPTIONAL: an integration whose client id is
# unset renders "Coming soon" on the Settings > Integrations page and cannot be
# installed. Set only the vendors you are actually testing.

# Slack
SLACK_BOT_TOKEN="***********************"
SLACK_CLIENT_ID=""
SLACK_CLIENT_SECRET=""
SLACK_SIGNING_SECRET=""
SLACK_OAUTH_REDIRECT_URL=""

# Onshape
ONSHAPE_CLIENT_ID=""
ONSHAPE_CLIENT_SECRET=""
ONSHAPE_OAUTH_REDIRECT_URL=""

# Xero
XERO_CLIENT_ID=""
XERO_CLIENT_SECRET=""
XERO_WEBHOOK_SECRET=""

# QuickBooks Online
QUICKBOOKS_CLIENT_ID=""
QUICKBOOKS_CLIENT_SECRET=""
QUICKBOOKS_ENVIRONMENT="sandbox"
QUICKBOOKS_WEBHOOK_SECRET=""

# Jira
JIRA_CLIENT_ID=""
JIRA_CLIENT_SECRET=""
JIRA_OAUTH_REDIRECT_URL=""
JIRA_STATE_SECRET=""

# Exchange rates
EXCHANGE_RATES_API_KEY=""

# Ramp (Spend Management). Carbon's single registered Ramp OAuth app — the
# "Connect to Ramp" flow uses these for every company. Register a third-party app
# in the Ramp Developer Console with the Authorization Code + Refresh Token grants
# and allowlist the redirect URI `<your ERP origin>/api/integrations/ramp/oauth`.
# The client id is public (it appears in the authorize URL); the secret is
# server-only. Without RAMP_CLIENT_ID the integration shows "Coming soon".
# RAMP_CLIENT_ID="ramp_id_********************"
# RAMP_CLIENT_SECRET="ramp_sec_********************"

# AI
ANTHROPIC_API_KEY="sk-ant-***************"
OPENAI_API_KEY="sk-proj-*****************"
EXTRACTION_CONFIDENCE_THRESHOLD="0.85"
# Custom local/cloud models (e.g. Gemini, DeepSeek, Qwen via Ollama)
# AI_MODEL="model"
# AI_BASE_URL="api_url"
# AI_API_KEY="sk-..."

# Google Places
GOOGLE_PLACES_API_KEY="*******************"

# Google OAuth app for workflow integration connections (Google Calendar, Gmail).
# Register at https://console.cloud.google.com/apis/credentials and add the
# redirect URL below to the app's authorized redirect URIs.
GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
GOOGLE_OAUTH_REDIRECT_URL=""

RATE_LIMIT="10"

# Enterprise SAML SSO (Enterprise edition only). Generate the key with:
#   openssl genpkey -algorithm RSA -out /tmp/pk.pem -quiet && \
#   openssl rsa -in /tmp/pk.pem -outform DER -traditional -out /tmp/pk.der && \
#   base64 -i /tmp/pk.der   # (base64 -w 0 /tmp/pk.der on Linux)
# The key MUST be base64-encoded PKCS#1 DER (the -traditional flag), min 2048-bit.
SAML_ENABLED=false
SAML_PRIVATE_KEY=