.env.example

# Copy this file to .env and fill in your values. .env is gitignored — never
# commit real credentials.

# --- Database ---------------------------------------------------------------
DATABASE_URL=postgresql+psycopg2://user:password@localhost:5432/pyfinbot
ASYNC_DATABASE_URL=postgresql+asyncpg://user:password@localhost:5432/pyfinbot
# DB_ECHO=false

# --- Auth ---------------------------------------------------------------
# Signs JWT access tokens. If unset, a random key is generated on every
# process start (fine for local dev, but every restart invalidates all
# issued tokens) — set this explicitly for any deployment that needs to
# survive a restart.
SECRET_KEY=<a long random string>
# ACCESS_TOKEN_EXPIRE_MINUTES=1440

# --- Gmail (Commsec email ingestion) ----------------------------------------
# Only needed to use POST /api/emails/sync-commsec, which reads Commsec trade
# confirmation emails via IMAP. An App Password grants full mailbox read
# access (not scoped to Commsec mail), so a dedicated Gmail account or label
# is recommended over your primary inbox.
GMAIL_ADDRESS=you@gmail.com
GMAIL_APP_PASSWORD=<a Gmail App Password, not your regular password>
# GMAIL_IMAP_HOST=imap.gmail.com
# GMAIL_IMAP_PORT=993
# GMAIL_MAILBOX=INBOX
# COMMSEC_SENDER=bounceback@commsec.com.au

# --- Environment & CORS -----------------------------------------------------
# "development" (default) allows all cross-origin requests when CORS_ORIGINS
# is unset, for frictionless local/Swagger testing. "production" allows none
# by default — set CORS_ORIGINS explicitly to permit any cross-origin access.
ENVIRONMENT=development
# CORS_ORIGINS=https://app.example.com,https://admin.example.com