.env.example

# WARNING: This file is for LOCAL DEVELOPMENT ONLY.
# NEVER use these values in production. The OIDC_RSA_PRIVATE_KEY below is publicly
# known and would allow anyone to mint valid OAuth tokens if used in production.

OIDC_RSA_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC9xkdpw4vlgFhm\n7u6uhGOc/O60VntTEG8VRRd/WwykG/6z7ZcLjs3fTzA0XOCR6r0E+HnauKydm3fC\nhqMTLpcnbJJ3GR0NvprEfoM1Is4omx827+CtQimvS/ymG7udW4X59JWyr/BIy2u4\npGjdZYZR/GhMx+nrdj4tIpiZgot5hMnzFoPNoyj6KHlvl6nuOFIlxzTHhKk1DLrK\nabDj8t7xcVolMp/hdN8EaztGqjOwd682gIAgRN1UoBRbOmXnLeHvHPryPjOsaJnR\nWmNvRJEXI6Zagcu4/GGg/3Hbd5rltD+rQtWGzqQTKLd0rZtFMI/I4i+CGiF4c4bD\nQ2/pqJnlAgMBAAECggEADmnr7KLh55mFnV59GcY2ZqsTWkvN7B4twbjQsxHwS4VQ\n0CELPYvSzn446WaQgU9fR0G0HPe1LKICnkS+8sBcJ1i+EHZY2D1nizsXWMbUT7iQ\neLS5ejoHPn2P//HP9dYIvqu5XwFb8mYjlWTvY2Qdp/EliYdkQ0e6KzrFymBkRY4T\nPlaPG5pcz8nWqIiRTLozBx4/glkuawNgwMawQH8paatsHP4BV82wtXTUHlb5pukh\nJTsTA6c4DaGnGQqP5ozxVKj30OdJTAgQiRXVfXBAD7uM+VokyiBA8wb6Zq/5+wfd\ny7TV9BNb2X+nZ3Cz4+3rsA8vVu9KHZFoYGPJEwZodQKBgQDdzkgNph2Broc8ADzc\nlCTR1tDI+pSF6DiOGlExlgFANd7QmCs0JiRiJd15NdOKsc/8/Gg4qou+p1CPpFCT\n1SQvWG1CI68jx9ql2HwA5KuvJ0CpNheqzV7w6a4mlaTMSl2nU8o3zg9H60qpqhf5\nWhsmMAskGVgubXMykn9hGbdFAwKBgQDbB9yZUvBZTZXD6/UQy5t6EbISsY8egdQ8\n7oabW8HUUGJb3Cf1ZtkTbk5z6xEwBVFgibsk+07zH6vQfHjvcrvbNEk3Es0B55rD\nntkBs85GcuGHlDMXbSFEl5Ju9wxJzDi0yYKCEv2YApbYiiM3+Y/wEdOPpWDHZ1Mz\nv65DF32s9wKBgEb97zHvKSKIqeAac2BmSiKfjtPE4CS73t4crkAgsuXKWDaLfciD\nLMH9PJW/FKYfo2JlpzX74B51juNqxB+M6Lf+pXm10iixntnWIFpo1kqJVbjTB2Az\nu1+Aa60N2GFKrA8SUnbqDRoHxS3osyOsI2RlnCtBsWeqwGQ/X2XExVPhAoGAajfn\nzRshn802Qesdz2VOIuaN+u7Mvziq2lm6QYFAAFxzNqUPY7zarMejmCd5EFaj3jMs\n5IRTByhmxBZ493Ymj+lNUD332WKd9RwFlQPDlvqDUKKYHFY5+e+ffdykwu0c2t+W\nQMpA3QT0blKfPbfzC7M5a8IBqvH6sW/VbIfp1IUCgYAZzK+ydq4vXmm2h7BEKb69\nUNlgIXzR8/jLz7/FIhhNnS3LQmeuwmLAYIbFvysJvDSgChly8GPNwp70T4YU5SjR\nobN2DVb4Yvt/Qwt87zvqeFkSeIoET85PazLoEu9FEZIA07l+tgd8oCAFxj+UOKtW\nZvTZbQ291ZAXRPjiFf4/oA==\n-----END PRIVATE KEY-----"

# WARNING: This is for LOCAL DEVELOPMENT ONLY - it should never be used in production.
# RS256 private key for sandbox JWT authentication (public key is derived from this)
SANDBOX_JWT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDMAaMESiOX8PDM\nozOHunt1s+zp78nmLnHs6IvOoKS4rQXFVV2/ouTivIfLRMRDe2TAybsYK0yfAJeK\nFxW7O+MD/vjCMS7kJtOjskQIl3wQTjz/T4fwHkFpiqVHLWczeO5LdvaJBZ4FUYdc\nLaV+9T+4wEavJa5G/Ggl+9eWee/TuThN21wMuAQb7WZhWKqDVm8WfmZpvOXJJ/U1\nkg+8GVg7eMTs6GV0MI7YYwzEHRn3PUQrQmc+q6gROwHU7pEv8DdOLjDH5iYZL/4k\ndnW1KGO/Hqf7vzKEMN23YjL6bC4FDRfM5z/4nQUEjvXihzZ1yK6yChwEd7Ma/PUG\nIh6Pm5azAgMBAAECggEAE/nlDeUkmcWMuWe8WAIOrMvdhbARQ7+F2v46Z7/wi+ow\nB86qy2UWpzfGzu9WOIq7UZVvWJfaJ4erTxOg8SCVbi1oC7vn14y7FJW+y7M/AWm9\nLKg2VhuK/twGAHOVs23tXOkH4wrwb5ziyvKSo109zB19I7wQ1f/z7XmSTA3Mn3Kf\n6GecR6di+LuDUNeEPwuP061EnUUsSYZY/QnhUNHfAyWaO4Ezc4bdl8w2q3O1ElBo\ndaYx9ht9aw8bTjIAS6QUdnh3OPXrQ/E7+2RaEh6NFFuXsh93aGSXKB6ZgURk0wIc\nBtNGA5Sxur8nwMfYT+6Z8fi7wMGuGtKISNK+DXCVwQKBgQD+nG92xjZebauJaYOn\nK7cDgWza9zwG6nDv13vRPS+D9wlJP3eUH1O+vZsar9UdTrXGh51oBskc4giOK9aL\nOvp9SjfrRx9KbkLLTzcS+r0XIYog0TO0onswaJ+ybwuvXU6zx+GjoKmPFDYrsjC5\n/3AkBPgEhorM4bZ1plfsFMzbaQKBgQDNHogqPPIXSco9ESTA6b3IeyzEGVcODDFq\nZgEIuFZJ70FCgg+TfxvZyQKfEGjxg6nLKQswaAQ7Pt3yMvYmEiVTrxaLBIjG9Lu8\nTWOMmJDiA7rgFVsU5ENI6UH8Nv8FkS5JSAPgC8hFnLKvs/9RjCTET3UCGoK5ymdM\nO1c/L0epuwKBgDYLUKGeizXaA5pEWlymq89Drq5/4i75noVacP7GBQr26fKxVRmM\n2MLZDk5I2mzBI1aDvMazAgdudzBuX7joCPmFQn9fdmXfJ7BuHRubO33ocaBrp5UF\nFC7/Vj6S0aEkpisFF4Ea/kLPoHv/89XXQZ9zqo2TXW0F0CwC5hDHjYBZAoGAG4IN\ntsRnnxHpSllDOY/fQMSsEzxmvV6LPf6iAt5dzBqHAPlaR2iTfpiDfnt/52vF2JYP\nhxVcA+oBb9q/wglK8jcX6drY0P2/M5iZUiCfxX/EjwquJVYbY+rMS5vAhambsH40\n7tYFrLhACmo0QmZuA9m4EmklwO7Q/ZszryiTDsMCgYBUUMWlQfuTN8m+D/Eo614J\neRYx8/YcaQpASOzy74woAZyHGLjuu5eW9wclkdhklHGh6KyQ5B6JUXlQsbZxLbBb\n9oW6Jg+UvL0KKLqHoNmNitiAUGONrVpxLjrKUUrUfDD+sWsxQpzcOgBqalTZ2g30\nN6ctjTLJp5PqIIE9tZB9PQ==\n-----END PRIVATE KEY-----"

# Point this to your PostHog Desktop monorepo root to use the local version of your @posthog/agent package instead of the published version. This is useful for testing changes to the agent package locally without needing to publish a new version.
LOCAL_POSTHOG_CODE_MONOREPO_ROOT=/path/to/posthog-code

# Sandbox provider (you can choose between "docker" or "modal")
SANDBOX_PROVIDER=docker

# MCP URL the sandbox container reaches the host's MCP server at.
# host.docker.internal resolves to the host from inside the Docker sandbox.
SANDBOX_MCP_URL=http://host.docker.internal:8787/mcp

# You probably want this on in development
DEBUG=1

# GitHub App credentials - see docs/internal/sandboxes-setup-guide.md)
# GITHUB_APP_CLIENT_ID=
# GITHUB_APP_CLIENT_SECRET=
# GITHUB_APP_SLUG=
# GITHUB_APP_PRIVATE_KEY=

# Max hands-free mode (ElevenLabs Scribe for STT + ElevenLabs TTS for voice playback)
ELEVENLABS_API_KEY=
# ELEVENLABS_API_BASE_URL=https://api.elevenlabs.io
# ELEVENLABS_STT_MODEL_ID=scribe_v1
# ELEVENLABS_VOICE_ID=21m00Tcm4TlvDq8ikWAM
# ELEVENLABS_TTS_MODEL_ID=eleven_turbo_v2_5

# Browserless renders heatmap screenshots and image exports — there is no in-container browser.
# Local dev: start the optional service first, then set the values below.
#   docker compose -f docker-compose.dev.yml --profile browserless up -d browserless
# Heatmap screenshots (REST API). blockAds is a browserless.io cloud-only API extension that the
# self-hosted OSS image rejects, so leave it off against the local container. (Consent-modal
# blocking is opted into per heatmap and stays off by default — no env var.)
#   HEATMAP_BROWSERLESS_URL=http://localhost:4445
#   HEATMAP_BROWSERLESS_TOKEN=dev
HEATMAP_BROWSERLESS_URL=
HEATMAP_BROWSERLESS_TOKEN=
# HEATMAP_BROWSERLESS_TIMEOUT_MS=180000
# HEATMAP_BROWSERLESS_CONNECT_TIMEOUT_MS=30000
# HEATMAP_BROWSERLESS_BLOCK_ADS=false

# Image exports (CDP). The containerized browser must reach SITE_URL, and `localhost` inside the
# container is not your machine — remap it via Chromium launch args (URL-encoded JSON below decodes
# to {"args":["--host-resolver-rules=MAP localhost host.docker.internal"]}):
#   BROWSERLESS_CDP_URL=ws://localhost:4445?launch=%7B%22args%22%3A%5B%22--host-resolver-rules%3DMAP%20localhost%20host.docker.internal%22%5D%7D
#   BROWSERLESS_TOKEN=dev
# Alternatively, with Docker Desktop host networking enabled, run browserless with
# `--network host` and plain BROWSERLESS_CDP_URL=ws://localhost:3000 works.
# BROWSERLESS_CDP_URL=
# BROWSERLESS_TOKEN=
# BROWSERLESS_SESSION_TIMEOUT_MS=180000
# BROWSERLESS_CONNECT_TIMEOUT_MS=30000