crawlproof.com/.env.example at master · profullstack/crawlproof.com · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# Public site URL (used for share links, OAuth callbacks, etc.)
NEXT_PUBLIC_SITE_URL=http://localhost:3000
NEXT_PUBLIC_SELF_AUDIT_URL=

# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://YOUR-PROJECT.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=YOUR_ANON_KEY
SUPABASE_SERVICE_ROLE_KEY=YOUR_SERVICE_ROLE_KEY

# Optional tracker geolocation. The .mmdb file is local-only and ignored by git.
# Get a free license key from MaxMind, then run:
#   npm run download-geolite2
MAXMIND_LICENSE_KEY=
MAXMIND_GEOLITE2_CITY_DB_PATH=data/GeoLite2-City.mmdb

# Ad network: slot credited when a serving request names none (a bare curl of
# /api/ads/motd). Without it, slotless requests can only return the house ad.
ADS_DEFAULT_SLOT_ID=

# Secret salt for every client-IP hash (ad metering + abuse caps). Unset falls
# back to the legacy unsalted digest, which is brute-forceable across the whole
# IPv4 space. Generate with `openssl rand -base64 32`.
IP_HASH_SALT=

# CoinPay credit purchases
COINPAY_MERCHANT_ID=merchant_xxx
COINPAY_API_KEY=cp_xxx
COINPAY_API_URL=https://coinpayportal.com/api
COINPAY_WEBHOOK_SECRET=change-me-to-a-long-random-string

# Resend
RESEND_API_KEY=re_xxx
RESEND_FROM="CrawlProof <reports@crawlproof.com>"

# Recent-scan outreach email. SMTP takes precedence over Resend when set.
# Forward Email works with SMTP_HOST=smtp.forwardemail.net, SMTP_PORT=465,
# SMTP_SECURE=true, and the full alias address as SMTP_USER.
SMTP_HOST=
SMTP_PORT=465
SMTP_USER=
SMTP_PASS=
SMTP_SECURE=true
SMTP_FROM="CrawlProof <reports@crawlproof.com>"

# Recent-scan outreach SMS. Twilio is preferred when configured; Telnyx is the fallback.
TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=
TWILIO_FROM=
TELNYX_API_KEY=
TELNYX_FROM=

# Worker — keep WORKER_PORT in lockstep with the port in WORKER_URL. The
# worker binds to 127.0.0.1:WORKER_PORT inside the container, and Next.js
# POSTs to WORKER_URL; a mismatch silently breaks every enqueue.
WORKER_URL=http://localhost:9080
WORKER_PORT=9080
WORKER_SHARED_SECRET=change-me-to-a-long-random-string

# Cron (Vercel cron will pass this header)
CRON_SECRET=change-me-to-a-long-random-string

# SameBrain — the trend source the ad network targets on (chovy.com). The
# secret is the same value that service has; put both in the vault
# (logicsrc team `crawlproof-com--prod`) and set them on the deployment, never
# in a committed .env file. Unset means no trend ingestion, which degrades to
# ordinary untargeted delivery rather than to an error.
# Ingest hourly: POST /api/cron/ad-trends with the cron secret.
SAMEBRAIN_URL=https://chovy.com
SAMEBRAIN_SECRET=

# Paid scan engines
# Backend text generation for Autoblog/profile enrichment:
#   auto = Anthropic when available, otherwise OpenAI
#   openai = prefer OPENAI_API_KEY, fall back to Anthropic if needed
#   anthropic = prefer ANTHROPIC_API_KEY, fall back to OpenAI if needed
BACKEND_AI_PROVIDER=openai
# Autoblog article models. Defaults are the frontier tier of each provider;
# override to trade quality for price (e.g. gpt-5.6-terra, claude-sonnet-5).
BACKEND_AI_OPENAI_MODEL=gpt-5.6-sol
BACKEND_AI_ANTHROPIC_MODEL=claude-opus-5
ANTHROPIC_API_KEY=
OPENAI_API_KEY=
GEMINI_API_KEY=
DASHSCOPE_API_KEY=
MOONSHOT_API_KEY=
DEEPSEEK_API_KEY=
# Optional — defaults to deepseek-v4-flash. The only other live model is
# deepseek-v4-pro; the old deepseek-chat alias was retired and now 400s.
DEEPSEEK_MODEL=
ZAI_API_KEY=
# Optional — defaults to the GLM Coding Plan endpoint. Set to
# https://api.z.ai/api/paas/v4 to use pay-as-you-go API billing instead.
ZAI_BASE_URL=
PERPLEXITY_API_KEY=

# Autoblog keyword research
DATAFORSEO_LOGIN=
DATAFORSEO_PASSWORD=

# Social posting token encryption and API tokens
SOCIAL_VAULT_KEY=
SP_TOKEN_PEPPER=

# OAuth / publishing integrations
REDDIT_CLIENT_ID=
REDDIT_CLIENT_SECRET=
REDDIT_USER_AGENT="web:com.crawlproof.social:v1.0 (by /u/crawlproof)"
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=
X_CLIENT_ID=
X_CLIENT_SECRET=
META_APP_ID=
META_APP_SECRET=
META_GRAPH_VERSION=v21.0

# GitHub App
GITHUB_APP_ID=
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=
GITHUB_APP_PRIVATE_KEY=
GITHUB_APP_SLUG=

# Playwright owner-flow e2e. Email defaults to anthony+riotcoder@profullstack.com.
PLAYWRIGHT_AUTH_EMAIL=
PLAYWRIGHT_AUTH_PASSWORD=

# Crawl gateway (@profullstack/x402-gateway): AI training crawlers pay $1/day over
# x402. A SCOPED CoinPay key (payments:create) and the EVM address that receives
# the USDC. Unset = crawlers still get 402, nothing sold.
COINPAY_X402_KEY=
CRAWL_PAY_TO=