.env.example

# sub2api Dashboard BFF (Node.js 22, single instance)
NODE_ENV=production
HOST=0.0.0.0
PORT=3000
SUB2API_BASE_URL=https://sub2api.example.com
SUB2API_ADMIN_API_KEY=replace-me
PUBLIC_ORIGIN=https://dashboard.example.com
GROUP_ALLOWLIST_JSON=[{"slug":"team-a","upstreamId":1,"label":"Team A","platformHint":"Anthropic"}]
# Generate each key separately; never reuse values or commit the generated output.
# Node 22: node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
# OpenSSL: openssl rand -base64 32 | tr '+/' '-_' | tr -d '='
SESSION_COOKIE_KEY=replace-with-32-byte-base64url
# Independent AES-256-GCM vault keyring. Retain old IDs until every session expires.
SESSION_VAULT_ACTIVE_KEY_ID=v1
SESSION_VAULT_KEYS_JSON={"v1":"replace-with-fourth-distinct-32-byte-base64url"}
# Dedicated dashboard Redis; do not reuse an upstream Redis instance.
# Compose uses this URL-safe password directly in REDIS_URL. Generate base64url only.
DASHBOARD_SESSION_REDIS_PASSWORD=replace-with-url-safe-base64url-password
REDIS_URL=redis://:replace-with-url-safe-base64url-password@dashboard-session-redis:6379
REDIS_KEY_PREFIX=sub2api-dashboard:
REDIS_CONNECT_TIMEOUT_MS=3000
CSRF_HMAC_KEY=replace-with-another-32-byte-base64url
ACCOUNT_REF_HMAC_KEY=replace-with-third-32-byte-base64url
COOKIE_SECURE=true
TRUST_PROXY=true
BODY_LIMIT=65536
UPSTREAM_RESPONSE_LIMIT=2000000
UPSTREAM_TIMEOUT_MS=8000
ANONYMOUS_TTL_MS=600000
AUTH_IDLE_TTL_MS=604800000
AUTH_ABSOLUTE_TTL_MS=2592000000
ACCOUNT_CACHE_TTL_MS=20000
USAGE_CACHE_TTL_MS=90000
STALE_TTL_MS=120000
PAGE_SIZE=100
MAX_PAGES=100
MAX_ACCOUNTS_PER_GROUP=1000
GROUP_CONCURRENCY=4
GLOBAL_CONCURRENCY=16
RATE_LIMIT_MAX=120
RATE_LIMIT_WINDOW=1 minute
WEB_DIST=apps/web/dist