.env.example

# Copy to .env for local development. Never commit .env.
# Platforms inject PORT themselves — leave it unset there.

NODE_ENV=development
PORT=8787
HOST=0.0.0.0

# Public HTTPS origin this service is reachable at. Required once OAuth lands:
# agent hosts reject http:// and OAuth 2.1 mandates TLS.
# Local development: use a tunnel, e.g. cloudflared tunnel --url http://localhost:8787
# PUBLIC_URL=https://mcp.ottopus.xyz

# Supabase Postgres. Long-lived container, so use the direct connection or the
# session pooler — the transaction pooler (6543) does not support prepared
# statements and postgres.js uses them by default.
# DATABASE_URL=postgresql://postgres:...@db.<ref>.supabase.co:5432/postgres

# No Supabase API key is needed. We talk to Postgres directly with drizzle over
# postgres.js, not through PostgREST or supabase-js, and auth is Privy. The
# legacy service_role key has no role here — DATABASE_URL is the only credential.

# Privy. Both come from the dashboard, and neither is a secret: the app id
# identifies the app, and the verification key is the public half of the ES256
# pair Privy signs access tokens with. The service verifies tokens offline
# against it and never calls Privy's API, so there is no app secret to hold.
# The key is accepted as SPKI PEM or as a JWK, whichever the dashboard gives.
# PRIVY_APP_ID=
# PRIVY_JWT_VERIFICATION_KEY=

# Browser origins allowed to call /api, comma-separated. The web app is always
# cross-origin, so this is not optional — but the defaults already cover local
# development and ottopus.xyz, so only set it for a preview deployment or a
# different domain.
# WEB_ORIGINS=http://localhost:3000,https://ottopus.xyz

# Zerion, the portfolio provider. Unlike the Privy values this is a real
# secret: it is an HTTP Basic credential, so it stays in the service and the
# browser never sees it. Get one from https://dashboard.zerion.io
# Without it /api/portfolio answers 503 and the rest of the service is fine.
# ZERION_API_KEY=

# Points the connector somewhere else. Only for tests and local mocks.
# ZERION_API_URL=https://api.zerion.io/v1

# Routing provider (swaps and bridges). Optional: LI.FI answers without a key
# at a low rate limit, and a free key raises it. Never reaches the browser.
# LIFI_API_KEY=
# LIFI_API_URL=https://li.quest

# One RPC provider for every chain. {network} is substituted with Alchemy's
# network name (base-mainnet, arb-mainnet, …) and {chainId} with the EVM id,
# for providers that route by number. Unset means viem's public endpoint per
# chain, fine on a laptop and rate-limited for a demo. A chain the provider
# does not serve falls back to the public endpoint. Reading only — the service
# never sends a transaction. Get a key from https://dashboard.alchemy.com
# RPC_URL_TEMPLATE=https://{network}.g.alchemy.com/v2/YOUR_ALCHEMY_KEY