# Dev-only defaults — fine for local. Rotate before deploying anywhere real.

# Used to encrypt JWT tokens

PAYLOAD_SECRET=dev_payload_secret_change_me_32_chars_min

# Used to configure CORS, format links and more. No trailing slash

NEXT_PUBLIC_SERVER_URL=http://localhost:3000

# Secret used to authenticate cron jobs

CRON_SECRET=dev_cron_secret_change_me_32_chars_minimum

# Used to validate preview requests

PREVIEW_SECRET=dev_preview_secret_change_me_32_chars_min

# Required by BetterAuth — must be at least 32 chars

BETTER_AUTH_SECRET=dev_better_auth_secret_change_me_32_chars

BETTER_AUTH_URL=http://localhost:3000

DATABASE_URL=postgres://coldflow:coldflow@localhost:5432/coldflow

DATABASE_URL_PAYLOAD=postgres://coldflow:coldflow@localhost:5432/payload

# Google OAuth for Gmail integration

GOOGLE_CLIENT_ID=27251904630-s5f1vp3ug9l6ji2vgl5g89huepgi57at.apps.googleusercontent.com

NEXT_PUBLIC_GOOGLE_CLIENT_ID=27251904630-s5f1vp3ug9l6ji2vgl5g89huepgi57at.apps.googleusercontent.com

# Google OAuth Client Secret (required for token exchange)

# Get this from Google Cloud Console > APIs & Services > Credentials

GOOGLE_CLIENT_SECRET=YOUR_GOOGLE_CLIENT_SECRET_HERE

# Gmail Encryption Key for storing OAuth tokens (32 bytes, base64 encoded)

# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

GMAIL_ENCRYPTION_KEY=YOUR_32_BYTE_BASE64_KEY_HERE

# Gmail OAuth Redirect URI (must match Google Cloud Console configuration)

GMAIL_OAUTH_REDIRECT_URI=http://localhost:3000/api/email-accounts/oauth/callback

# Webhook secret for securing tracking endpoints

GMAIL_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_HERE

# Silent-reply follow-up: days between prospect reply and the auto follow-up.

# Pulled at runtime so we can tune in prod without a deploy.

REPLY_FOLLOWUP_OFFSET_DAYS=3