.env.example

# Environment
# Application runtime environment — affects logging format, error detail, and security options (default: development)
NODE_ENV=development

# Server
# Port the HTTP server binds to (default: 3000)
PORT=3000
# API version segment injected into every route prefix (default: v1)
API_VERSION=v1
# Base path prefix for all routes (default: /api)
BASE_URL=/api

# Database
# Full PostgreSQL connection URL — must be a valid URL
# Format: postgresql://<user>:<password>@<host>:<port>/<database>
DATABASE_URL=postgresql://postgres:password@localhost:5432/mydb

# JWT
# Secret used to sign access tokens — minimum 32 characters
JWT_SECRET=change_me_to_a_long_random_string_of_at_least_32_chars
# Secret used to sign refresh tokens — minimum 32 characters, different from JWT_SECRET
JWT_REFRESH_SECRET=another_long_random_string_that_is_also_at_least_32_chars
# Access token expiry expressed as a zeit/ms string or seconds number (default: 15m)
JWT_EXPIRE_TIME=15m
# Refresh token expiry expressed as a zeit/ms string or seconds number (default: 7d)
JWT_REFRESH_EXPIRE_TIME=7d

# CORS
# Origin URL of the frontend client — must be a valid URL
CLIENT_URL=http://localhost:3001

# Security
# bcrypt cost factor for password hashing — must be between 10 and 15 (default: 12)
BCRYPT_SALT_ROUNDS=12
# Secret used to sign cookies AND as the CSRF HMAC key — minimum 32 characters, different from JWT secrets
COOKIE_SECRET=yet_another_long_random_string_that_is_at_least_32_chars