.env.example

# Google AI API key (platform free tier — primary model provider)
# Get one at https://aistudio.google.com/
GOOGLE_AI_API_KEY=

# Anthropic API key (optional — for dev/fallback)
# Get one at https://console.anthropic.com/
ANTHROPIC_API_KEY=

# MCP gateway URL (default: local gateway)
MCP_GATEWAY_URL=http://localhost:8000/mcp

# MCP gateway auth token (optional locally, required in production)
# Set the same token on the Railway gateway as MCP_AUTH_TOKEN
MCP_AUTH_TOKEN=

# Vercel Postgres / Neon connection string
DATABASE_URL=

# NextAuth secret — generate with: openssl rand -base64 32
NEXTAUTH_SECRET=

# NextAuth base URL
NEXTAUTH_URL=http://localhost:3000

# Resend API key for magic-link emails
# Get one at https://resend.com/
RESEND_API_KEY=

# From address for magic-link emails (must be a verified Resend sender)
EMAIL_FROM=

# 32-byte hex secret for BYOK key encryption — generate with: openssl rand -hex 32
ENCRYPTION_SECRET=

# Vercel AI Gateway API key (optional — enables unified routing, per-request costs,
# and native BYOK/platform distinction). Get one at vercel.com/<team>/~/ai-gateway/api-keys
AI_GATEWAY_API_KEY=

# Set to "1" to route platform-key traffic through the Vercel AI Gateway.
# Any other value (unset, "0") keeps the existing direct-SDK path. BYOK is never routed.
USE_AI_GATEWAY=

# Stats NZ (Aotearoa Data Explorer) subscription key — injected by /api/sdmx-proxy
# on every request to api.data.stats.govt.nz. Scope to Production only in Vercel so
# branch preview URLs don't expose an unauthenticated proxy with the key.
SDMX_STATSNZ_KEY=