.env.example

# Noblocks Environment Variables
# Copy this file to .env.local and fill in your values
# See: docs/environment-variables.md for detailed info about each env. variable

# =============================================================================
# Core Application
# =============================================================================

# Aggregator API
NEXT_PUBLIC_AGGREGATOR_URL=https://api.paycrest.io/v1
# Sender API key UUID (aggregator dashboard): server proxy + client on-chain messageHash
NEXT_PUBLIC_AGGREGATOR_SENDER_API_KEY_ID=

# KYC tier monthly swap limits (USD). Omitted or empty = defaults below.
# Tier 3 also accepts "unlimited" (case-insensitive) to remove the monthly cap.
# Do not use 0 for unlimited — tier 0 uses 0 to mean "no swaps until phone".
NEXT_PUBLIC_KYC_TIER_0_MONTHLY=0
NEXT_PUBLIC_KYC_TIER_1_MONTHLY=0.5
NEXT_PUBLIC_KYC_TIER_2_MONTHLY=1
NEXT_PUBLIC_KYC_TIER_3_MONTHLY=2

# Authentication Services
NEXT_PUBLIC_PRIVY_APP_ID=
NEXT_PUBLIC_RPC_URL_KEY=

# Client error reporting (Sentry-compatible DSN, e.g. GlitchTip)
# Leave empty to disable. Optional: NEXT_PUBLIC_SENTRY_ENVIRONMENT, NEXT_PUBLIC_SENTRY_RELEASE
# Set NEXT_PUBLIC_SENTRY_ENABLE_IN_DEV=true to send events from local dev
NEXT_PUBLIC_SENTRY_DSN=

# =============================================================================
# Database & Authentication
# =============================================================================

# Supabase Database
# Get these from: Supabase Dashboard → Project Settings → API
SUPABASE_URL=https://your-project.supabase.co
# Optional Next.js-style URL (either works for server)
# NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
#
# Server API routes (supabaseAdmin): **Secret** key only — sb_secret
SUPABASE_SECRET_KEY=
#
# Client-only if you add a browser Supabase client later (not used by current server admin)
# NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=
#

# Privy Authentication
PRIVY_APP_SECRET=
PRIVY_JWKS_URL=https://auth.privy.io/api/v1/apps/<your-privy-app-id>/jwks.json
PRIVY_ISSUER=privy.io

# =============================================================================
# Analytics
# =============================================================================

# Client-side Analytics
NEXT_PUBLIC_MIXPANEL_TOKEN=
NEXT_PUBLIC_HOTJAR_SITE_ID=

# Server-side Analytics
MIXPANEL_TOKEN=
MIXPANEL_PRIVACY_MODE=strict
MIXPANEL_INCLUDE_IP=false
MIXPANEL_INCLUDE_ERROR_STACKS=false
NEXT_PUBLIC_ENABLE_EMAIL_IN_ANALYTICS=false

# =============================================================================
# Security
# =============================================================================

# Internal API Security
# Generate with: openssl rand -hex 32
INTERNAL_API_KEY=

# =============================================================================
# Feature Flags
# =============================================================================

# Enable wallet context sync in middleware
ENABLE_WALLET_CONTEXT_SYNC=false

# Starknet Earn (Vesu / Starkzap): wallet Earn CTA, deposit/withdraw, activity tab
NEXT_PUBLIC_EARN_ENABLED=false

NEXT_PUBLIC_TRON_ENABLED=false
# Optional: custom Tron RPC URL (defaults to https://api.trongrid.io)
# NEXT_PUBLIC_TRON_RPC_URL=
# Optional: TronGrid API key for balance lookups (higher rate limits)
# NEXT_PUBLIC_TRONGRID_API_KEY=

# Referral Program: show/hide all referral UI and API routes
NEXT_PUBLIC_REFERRAL_ENABLED=true

# Bridge/Swap (Convert): in-wallet cross-chain convert via NEAR Intents + LI.FI
NEXT_PUBLIC_BRIDGE_ENABLED=false
# NEAR Intents 1Click API JWT (server-side)
ONE_CLICK_JWT=
# LI.FI API key (server-side, optional)
LIFI_API_KEY=
# Default slippage tolerance for bridge quotes in basis points (e.g. 50 = 0.5%)
NEXT_PUBLIC_BRIDGE_DEFAULT_SLIPPAGE_BPS=50

# Embeddable widget (/widget route, iframed by whitelisted partners)
NEXT_PUBLIC_EMBED_ENABLED=false
# Comma-separated origins allowed to iframe /widget (CSP frame-ancestors).
# Must be https:// (http:// allowed only for localhost/127.0.0.1 in dev).
# Wildcard subdomains ok, e.g. https://partner.com,https://*.partner.app
# Merged with the embed_allowed_origins table (via /api/internal/embed-origins).
EMBED_ALLOWED_ORIGINS=
# Trusted absolute base URL the edge middleware uses to fetch the DB-backed
# allowlist (e.g. https://noblocks.xyz). Required to consult the
# embed_allowed_origins table; if unset, only EMBED_ALLOWED_ORIGINS is used.
# Never derived from the request Host header (avoids SSRF / key leakage).
INTERNAL_API_BASE_URL=

# =============================================================================
# Injected-Wallet Session Auth (SIWE)
# =============================================================================

# HMAC secret for injected-wallet session JWTs minted by
# /api/auth/injected/verify and verified by the middleware (x-injected-token).
# Generate with: openssl rand -hex 32
INJECTED_SESSION_SECRET=
# Canonical public origin of this deployment (e.g. https://noblocks.xyz).
# SIWE sign-in messages must name this host (or an allowed embed origin) —
# configured, never derived from the request Host header, so a signature
# phished on another domain can't mint a session here.
NEXT_PUBLIC_APP_URL=http://localhost:3000

# =============================================================================
# External Services
# =============================================================================

# SEO
NEXT_PUBLIC_GOOGLE_VERIFICATION_CODE=

# Notice Banner
# See docs/notice-banner.md
NEXT_PUBLIC_NOTICE_BANNER_TEXT=

# Maintenance Notice Modal
# Set to any truthy value (e.g. "1") to show the maintenance notice overlay.
# SCHEDULE is the bold date/time string shown in the notice body.
# Changing the schedule auto-resets dismissals so users see the new notice.
NEXT_PUBLIC_MAINTENANCE_NOTICE_ENABLED=true
NEXT_PUBLIC_MAINTENANCE_SCHEDULE=Friday, February 13th, from 7:00 PM to 11:00 PM WAT

# Brevo Email Marketing
# Get from: Brevo Dashboard → Settings → API Keys
BREVO_API_KEY=
# List ID from: Brevo Dashboard → Contacts → Lists (numeric ID)
BREVO_LIST_ID=
BREVO_LIST_ID=
# Brevo Conversations (Chat Widget)
# Get from: Brevo Dashboard → Conversations → Settings
NEXT_PUBLIC_BREVO_CONVERSATIONS_ID=
NEXT_PUBLIC_BREVO_CONVERSATIONS_GROUP_ID=

# Activepieces webhooks for KYC
ACTIVEPIECES_SIGNUP_VERIFY_WEBHOOK_URL=
ACTIVEPIECES_KYC_RESULT_WEBHOOK_URL=
# =============================================================================
# Phone Verification Services
# =============================================================================

# KudiSMS (for African phone numbers)
# Get from: KudiSMS Dashboard → Settings → API Keys
KUDISMS_API_KEY=your_kudisms_api_key
KUDISMS_APP_NAME_CODE=your_app_name_code
KUDISMS_TEMPLATE_CODE=your_template_code
KUDISMS_SENDER_ID=Noblocks

# Twilio (for international phone numbers via Verify API)
# Get from: Twilio Console → Account Dashboard
TWILIO_ACCOUNT_SID=your_twilio_account_sid
TWILIO_AUTH_TOKEN=your_twilio_auth_token
# Verify service SID: Twilio Console → Verify → Services → create or use default
TWILIO_VERIFY_SERVICE_SID=VAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# =============================================================================
# SmileID KYC Verification Services
# =============================================================================

# API base URL — see Smile Identity docs (sandbox vs production)
SMILE_IDENTITY_BASE_URL="XXXXXX"
# API key from Smile Identity portal
SMILE_IDENTITY_API_KEY="your_api_key_here"
# Partner ID from Smile Identity portal
SMILE_IDENTITY_PARTNER_ID="your_partner_id_here"
# Callback URL for async job results (e.g. https://your-host/api/kyc/smile-id/callback)
SMILE_ID_CALLBACK_URL=""
# "0" = sandbox, "1" = production (or a legacy full API URL string)
SMILE_IDENTITY_SERVER="0"

# =============================================================================
# Dojah – Tier 3 address / proof-of-address verification
# =============================================================================
# Replace with your own credentials from https://app.dojah.io/developers/configuration
DOJAH_APP_ID=<DOJAH_APP_ID_PLACEHOLDER>
DOJAH_SECRET_KEY=<DOJAH_SECRET_KEY_PLACEHOLDER>
DOJAH_BASE_URL=https://api.dojah.io
# Optional. Default false — send only input_type + input_value per Dojah docs (avoids some 5xx).
# DOJAH_UTILITY_BILL_SEND_ADDRESS_FIELDS=true
# Optional. Default true — if URL submission gets 500/502/503/504, retry with base64 (Dojah often cannot fetch Supabase URLs).
# DOJAH_UTILITY_BILL_BASE64_FALLBACK=false
# Supabase Storage bucket for KYC document uploads (create in Supabase Dashboard → Storage)
KYC_DOCUMENTS_BUCKET=kyc-documents

# =============================================================================
# Campaign Management (BlockFest)
# =============================================================================

# BlockFest Campaign End Date
# Format: ISO 8601 with timezone (YYYY-MM-DDTHH:mm:ss±HH:mm)
# Example: 2025-10-11T23:59:00+01:00 (October 11th, 2025 at 11:59 PM UTC+1)
NEXT_PUBLIC_BLOCKFEST_END_DATE=2025-10-11T23:59:00+01:00
# Noblocks Play (fantasy league). Keep ENABLED=true for /play announcement + /play/admin.
NEXT_PUBLIC_FANTASY_ENABLED=true
# When true, public /play shows the campaign-ended announcement (deep links redirect to /play).
# /play/admin stays available. Flip false to revive a live league after rebranding.
NEXT_PUBLIC_FANTASY_CAMPAIGN_ENDED=true
# World Cup footer Lottie (requires fantasy enabled and not campaign-ended; ends Jul 19 2026 by default)
NEXT_PUBLIC_WORLDCUP_FOOTER_END_DATE=2026-07-19T23:59:59+01:00

# BlockFest Cashback Wallet
# ⚠️ WARNING: These credentials control funds and must be kept secure
# - Never commit these values to version control
# - Use secure secret management in production (AWS Secrets Manager, Vault, etc.)
# - Rotate keys regularly
# - Restrict access to authorized personnel only
# - Private key must be in format: 0x followed by 64 hex characters (66 chars total)
CASHBACK_WALLET_ADDRESS=
CASHBACK_WALLET_PRIVATE_KEY=

# =============================================================================
# Content Management (Sanity)
# =============================================================================

# Sanity Studio (server-side)
SANITY_STUDIO_DATASET=production
SANITY_STUDIO_PROJECT_ID=your_project_id_here

# Next.js App (client-side)
NEXT_PUBLIC_SANITY_DATASET=production
NEXT_PUBLIC_SANITY_PROJECT_ID=your_project_id_here

# Bundler / EIP-7702 sponsor
NEXT_PUBLIC_BUNDLER_SERVER_URL=
SPONSOR_EVM_WALLET_PRIVATE_KEY=0x...

# Onramp chained forwarding
# When true, onramp crypto settles to the user's Noblocks wallet first, then is auto-forwarded
# (client-signed, gas-sponsored) to the user's chosen destination if it differs.
NEXT_PUBLIC_ONRAMP_CHAINED_FORWARDING_ENABLED=false

NEXT_PUBLIC_REFERRAL_MIN_QUALIFYING_VOLUME_USD=20 # in USDC
NEXT_PUBLIC_REFERRAL_REWARD_AMOUNT_USD=1 # in USDC