# Public: safe to expose to the browser (inlined into the client bundle at
# build time). Anon-key access is still fully gated by RLS server-side.
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=

# Server-only: bypasses Row Level Security entirely. Never prefix with
# NEXT_PUBLIC_, never import outside lib/supabase/admin.ts (guarded by
# `import "server-only"`), never log or return in an API response.
SUPABASE_SERVICE_ROLE_KEY=

# Shared secret Vercel Cron sends as `Authorization: Bearer <value>` when it
# calls /api/cron/apply-pending-changes (set the same value in the Vercel
# project's env vars). Generate with e.g. `openssl rand -hex 32`.
CRON_SECRET=