.env.example

## Optional for AI-assisted workflow and assistant features.
OPENAI_API_KEY=
OPENAI_MODEL_DEFAULT=gpt-5.4-mini
OPENAI_MODEL_HIGH_TRUST=gpt-5.4
OPENAI_MODEL_MID_TIER=gpt-5.4-mini
OPENAI_MODEL_PRODUCT_HELP=gpt-5.4-mini
OPENAI_MODEL_APPLICATION_QA=gpt-5.4
OPENAI_REASONING_DEFAULT=medium
OPENAI_REASONING_HIGH_TRUST=high
OPENAI_REASONING_PROFILE=medium
OPENAI_REASONING_JOB=medium
OPENAI_REASONING_FIT=medium
OPENAI_REASONING_TAILORING=medium
OPENAI_REASONING_STRATEGY=medium
OPENAI_REASONING_REVIEW=high
OPENAI_REASONING_RESUME_GENERATION=high
OPENAI_REASONING_PRODUCT_HELP=medium
OPENAI_REASONING_APPLICATION_QA=high

## Optional app base URL. Used as the default auth redirect URL when no
## explicit SUPABASE_AUTH_REDIRECT_URL is provided.
APP_BASE_URL=http://localhost:3000

## Required for the current login-first resume workflow, Google sign-in,
## persisted saved-workspace reload, and account-level quotas.
SUPABASE_URL=
SUPABASE_ANON_KEY=
SUPABASE_AUTH_REDIRECT_URL=http://localhost:3000/workspace
SUPABASE_APP_USERS_TABLE=app_users
SUPABASE_USAGE_EVENTS_TABLE=usage_events
SUPABASE_SAVED_WORKSPACES_TABLE=saved_workspaces
SUPABASE_SAVED_JOBS_TABLE=saved_jobs
SUPABASE_RESUME_BUILDER_SESSIONS_TABLE=resume_builder_sessions
SAVED_WORKSPACE_TTL_HOURS=24

## Optional job-search backend settings. Keep ENABLE_JOB_SEARCH_BACKEND=false
## until the separate backend service is available in the target environment.
ENABLE_JOB_SEARCH_BACKEND=false
JOB_BACKEND_BASE_URL=http://localhost:8000
JOB_BACKEND_HOSTPORT=
GREENHOUSE_BOARD_TOKENS=
LEVER_SITE_NAMES=

## Frontend origin settings for the Next.js transition.
FRONTEND_APP_URL=http://localhost:3000
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
## Leave AUTH_COOKIE_DOMAIN empty on localhost. In production, set it to
## your parent domain (for example, .job-application-copilot.xyz) so the
## landing and workspace subdomains share the same HttpOnly session.
AUTH_COOKIE_DOMAIN=
AUTH_COOKIE_SECURE=false
AUTH_COOKIE_SAMESITE=lax

## AI-assisted workflow and the in-app assistant are login-required in the
## active UI. This flag controls whether the workflow button also enforces that.
AUTH_REQUIRED_FOR_ASSISTED_WORKFLOW=true
AUTH_DEFAULT_PLAN_TIER=free
AUTH_DEFAULT_ACCOUNT_STATUS=active
## Only internal unrestricted testing accounts belong here.
## Leave normal quota-test accounts out of this list so they stay on the free-tier path.
AUTH_INTERNAL_USER_EMAILS=
FREE_TIER_MAX_CALLS_PER_DAY=12
FREE_TIER_MAX_TOKENS_PER_DAY=60000
PAID_TIER_MAX_CALLS_PER_DAY=80
PAID_TIER_MAX_TOKENS_PER_DAY=400000