.env.example

# Auth (Google OAuth + session). Only @audius.co / @audius.org can access.
GOOGLE_CLIENT_ID=your-google-oauth-client-id.apps.googleusercontent.com
NEXT_PUBLIC_GOOGLE_CLIENT_ID=your-google-oauth-client-id.apps.googleusercontent.com
AUTH_SESSION_SECRET=at-least-32-character-secret-for-jwt-signing

# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
# Storage: create bucket named "uploads" (Dashboard → Storage) for CSV + announcement images; public read recommended for push image URLs

# AWS SNS (for future stats / integrations — not required for the dashboard UI)
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1
AWS_SNS_PLATFORM_ARN_IOS=
AWS_SNS_PLATFORM_ARN_ANDROID=

# First-party push opens (Discovery via api.audius.co). Set the same secret as API `notificationCampaignOpenMetricsSecret`.
AUDIUS_API_URL=https://api.audius.co
NOTIFICATION_CAMPAIGN_OPEN_METRICS_SECRET=

# Vercel Cron: Authorization: Bearer <CRON_SECRET> (set in Vercel project env)
CRON_SECRET=

# Notifications service (for sending announcements via SNS)
NOTIFICATIONS_SERVICE_URL=http://localhost:6000
# Optional: shared secret for Authorization: Bearer <secret> (must match ANNOUNCEMENT_SEND_SECRET on the service)
ANNOUNCEMENT_SEND_SECRET=