osmt-staging.env.example

# Staging: Google OAuth2 + Single-Auth
# Both options presented on the login page

# Google OAuth2 - Create credentials in Google Cloud Console
# Redirect URI: {baseUrl}/login/oauth2/code/google
OAUTH_GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
OAUTH_GOOGLE_CLIENT_SECRET=your-client-secret

# Enable single-auth alongside OAuth (admin fallback on login page)
ENABLE_SINGLE_AUTH=true

# Admin credentials for single-auth option
SINGLE_AUTH_ADMIN_USERNAME=admin
SINGLE_AUTH_ADMIN_PASSWORD=secure-password

# Session Token
# APP_SESSION_TOKEN_EXPIRY_SECONDS controls both the JWT token expiry AND the
# server-side HTTP session timeout (in Redis). Default: 86400 (24 hours)
# APP_SESSION_TOKEN_EXPIRY_SECONDS=86400
#
# Session token secret - required for staging (or use dev profile for local)
# APP_SESSION_TOKEN_SECRET=base64-encoded-secret-min-256-bits

# Profiles: oauth2,single-auth (set via ENVIRONMENT or docker entrypoint)

# Credential Engine sync (optional - when absent, mock in dev / disabled in prod)
CREDENTIAL_ENGINE_API_KEY=
CREDENTIAL_ENGINE_ORG_CTID=
CREDENTIAL_ENGINE_REGISTRY_URL=https://sandbox.credentialengine.org
# CREDENTIAL_ENGINE_CANONICAL_URL_BASE=  # Optional. When empty, uses app.baseUrl. Must be publicly resolvable.