# Port the API listens on
PORT=4000

# OAuth client ID from Google Cloud Console (Web application).
# Must match the client ID used by the frontend's Google Sign-In button.
GOOGLE_CLIENT_ID=your-google-client-id.apps.googleusercontent.com

# Comma-separated list of email addresses that get admin access.
# Admins do not need a row in the employees table.
ADMIN_EMAILS=kamarad@example.com

# Secret used to sign session JWTs. Generate with: openssl rand -hex 32
JWT_SECRET=change-me-to-a-long-random-string

# Where the SQLite database file lives.
DB_PATH=./data/eatme.db

# Origin of the frontend app, for CORS + cookie settings.
CORS_ORIGIN=http://localhost:5173

# Set to "true" behind HTTPS in production so the session cookie gets Secure.
COOKIE_SECURE=false