.env.example

# Supabase (database only — auth is handled by Clerk)
NEXT_PUBLIC_SUPABASE_URL="https://your-project.supabase.co"
# Publishable key (sb_publishable_...) — replaces the legacy anon key.
# Client-safe and RLS-respecting. Requests carry the Clerk JWT and RLS matches
# its `sub` claim. (The code also accepts a legacy NEXT_PUBLIC_SUPABASE_ANON_KEY.)
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY="your-publishable-key"

# Clerk auth (https://dashboard.clerk.com -> API Keys)
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY="pk_test_..."
CLERK_SECRET_KEY="sk_test_..."
# Keep the app's existing auth routes and post-auth destination.
NEXT_PUBLIC_CLERK_SIGN_IN_URL="/login"
NEXT_PUBLIC_CLERK_SIGN_UP_URL="/signup"
NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL="/dashboard"
NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL="/dashboard"
# Clerk webhook (Dashboard -> Webhooks -> endpoint /api/webhooks/clerk,
# subscribed to user.created/updated/deleted) — authoritative user sync.
CLERK_WEBHOOK_SIGNING_SECRET="whsec_..."
# Service-role key (Supabase Dashboard -> API). SERVER-ONLY, bypasses RLS —
# used only by the Clerk webhook to sync users. Never expose to the browser.
SUPABASE_SERVICE_ROLE_KEY="sb_secret_..."

# Next.js
NODE_ENV="development"
NEXT_TELEMETRY_DISABLED=1

# Yjs Collaborative Editing
NEXT_PUBLIC_YJS_WEBSOCKET_URL=ws://localhost:3006

# AI lesson notes (Claude — https://console.anthropic.com)
ANTHROPIC_API_KEY=