.env.example

# -----------------------------------------------------------------------------
# Core settings
# -----------------------------------------------------------------------------
# Required for all modes. See README.md for setup instructions.
# DATAFORSEO_API_KEY=

# Optional app port
# PORT=3001

# Optional reverse-proxy hosts for Docker self-hosting
# ALLOWED_HOST=yourdomain.com

# Optional image tag override for Docker self-hosting
# OPEN_SEO_IMAGE=ghcr.io/every-app/open-seo:latest

# -----------------------------------------------------------------------------
# Auth mode
# -----------------------------------------------------------------------------
# - cloudflare_access: validate Cloudflare Access JWTs (recommended for deploys)
# - local_noauth: local trusted mode with injected admin user (admin@localhost)
# - hosted: Better Auth email/password + organization mode
#
# Defaults to cloudflare_access when unset.
# AUTH_MODE=cloudflare_access

# Required when AUTH_MODE=cloudflare_access
# TEAM_DOMAIN=https://your-team.cloudflareaccess.com
# POLICY_AUD=your-cloudflare-access-aud-tag

# Required when AUTH_MODE=hosted
# BETTER_AUTH_SECRET=replace-with-a-long-random-secret-at-least-32-characters
# BETTER_AUTH_URL=http://localhost:3001
# GOOGLE_CLIENT_ID=replace-with-your-google-oauth-client-id
# GOOGLE_CLIENT_SECRET=replace-with-your-google-oauth-client-secret
# POSTHOG_PUBLIC_KEY=replace-with-your-posthog-project-api-key
# POSTHOG_HOST=https://us.i.posthog.com
# LOOPS_API_KEY=replace-with-your-loops-api-key
# LOOPS_TRANSACTIONAL_VERIFY_EMAIL_ID=replace-with-your-loops-verify-template-id
# LOOPS_TRANSACTIONAL_RESET_PASSWORD_ID=replace-with-your-loops-reset-template-id

# Optional in self-hosted modes. Required if you want AI features like SAM,
# the in-app SEO agent. Create a key at https://openrouter.ai/settings/keys.
# OPENROUTER_API_KEY=replace-with-your-openrouter-api-key

# Optional in self-hosted modes. Required if you want Google Search Console
# integration and MCP tools. BETTER_AUTH_SECRET is also required for GSC (it
# encrypts the stored OAuth tokens). See docs/SELF_HOSTING_GOOGLE_SEARCH_CONSOLE.md.
# GOOGLE_CLIENT_ID=replace-with-your-google-oauth-client-id
# GOOGLE_CLIENT_SECRET=replace-with-your-google-oauth-client-secret
# BETTER_AUTH_SECRET=replace-with-a-long-random-secret-at-least-32-characters