Sentinel/.env.example at main · parbhatkapila4/Sentinel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# Sentinel - Environment variables for local development and deployment.
# Copy to .env.local and fill in values. See README.md and DEPLOYMENT.md for details.

# ── REQUIRED IN PRODUCTION ──────────────────────────────────────────────
# Stabilises Next.js Server Action IDs across deploys. Without this, every
# `next build` rotates the encryption key, which rotates the action IDs
# baked into already-served HTML - users with a tab open from before the
# deploy hit a stale action ID, the server returns a 404 to the action
# call, and the React server-action client surfaces it as the (uselessly
# generic) "An unexpected response was received from the server" error.
#
# Generate once, set in Vercel (or your host) project env, and DO NOT
# rotate it again unless you accept invalidating every in-flight session.
# To generate:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=

# Database
# Supabase: use the Transaction pooler string (host contains pooler.supabase.com, port 6543) for the app.
# Prisma adds pgbouncer=true + connection_limit at runtime if you use the pooler host - still recommended to include ?pgbouncer=true in the dashboard URL when copying.
DATABASE_URL=
# Supabase: "Direct connection" / session string (port 5432, not the pooler). Required for `npx prisma migrate` / `db push`.
# Local Postgres / Docker: set DIRECT_URL to the same value as DATABASE_URL.
DIRECT_URL=

# Clerk Authentication
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=
CLERK_SECRET_KEY=
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-in
NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=/dashboard
NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=/dashboard

# OpenRouter AI
OPENROUTER_API_KEY=

# OAuth integrations
# Required for Gmail OAuth flow (/api/oauth/gmail/*)
GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_SECRET=
# Required for HubSpot OAuth flow (/api/integrations/hubspot/oauth/*)
HUBSPOT_OAUTH_CLIENT_ID=
HUBSPOT_OAUTH_CLIENT_SECRET=
HUBSPOT_OAUTH_REDIRECT_URI=https://sentinels.in/api/integrations/hubspot/oauth/callback
# Required for Salesforce OAuth flow (/api/integrations/salesforce/oauth/*)
SALESFORCE_OAUTH_CLIENT_ID=
SALESFORCE_OAUTH_CLIENT_SECRET=
SALESFORCE_OAUTH_REDIRECT_URI=https://sentinels.in/api/integrations/salesforce/oauth/callback
# Required for Slack OAuth flow (/api/integrations/slack/oauth/*) + events webhook
SLACK_CLIENT_ID=
SLACK_CLIENT_SECRET=
SLACK_OAUTH_REDIRECT_URI=https://sentinels.in/api/integrations/slack/oauth/callback
SLACK_SIGNING_SECRET=

# Upstash Redis (optional - for email queue)
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# Resend Email (optional)
RESEND_API_KEY=
RESEND_FROM_EMAIL=notifications@yourdomain.com

# App URL
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Optional: hero "See how it works" opens this in a modal (YouTube watch URL, or MP4/WebM under /public e.g. /walkthrough.mp4, or full URL to a video file). If unset, the button links to /how instead.
# Other HTTPS links (e.g. Vimeo, Loom watch page) open in a new tab.
NEXT_PUBLIC_WALKTHROUGH_VIDEO_URL=

# Cron jobs (for /api/cron/*). Required to invoke /api/cron/* (Bearer); routes fail closed if unset.
CRON_SECRET=

# Integration secrets at rest (AES-256-GCM). Required when saving encrypted CRM/Slack webhook values.
# Generate a 32-byte key: openssl rand -base64 32
INTEGRATION_ENCRYPTION_KEY=

# Sentry Performance Monitoring (optional)
NEXT_PUBLIC_SENTRY_DSN=
NEXT_PUBLIC_SENTRY_ENABLE_PERFORMANCE=true
SENTRY_PERFORMANCE_SAMPLE_RATE=0.1

# PayPal billing (required for automatic paid-plan upgrades)
# Use "live" in production, "sandbox" for testing.
PAYPAL_ENVIRONMENT=sandbox
PAYPAL_CLIENT_ID=
PAYPAL_CLIENT_SECRET=
# Webhook ID from PayPal dashboard for the endpoint below:
# https://<your-domain>/api/billing/paypal/webhook
PAYPAL_WEBHOOK_ID=
# Optional strict amount mapping (comma-separated USD amounts). If unset,
# defaults to canonical prices from pricing catalog.
PAYPAL_PRO_ACCEPTED_AMOUNTS=31,20
PAYPAL_ENTERPRISE_ACCEPTED_AMOUNTS=85,56

# Security Notes:
# - CLERK_SECRET_KEY must be at least 32 characters
# - DATABASE_URL should use secure connection strings in production
# - All API keys should be kept secret and rotated regularly