# Zitadel OIDC (server-side auth)
ZITADEL_ISSUER=http://host.docker.internal:8080
ZITADEL_CLIENT_ID=your-web-app-client-id
ZITADEL_CLIENT_SECRET=your-web-app-client-secret

# Where Zitadel redirects back after login (must be registered in the app)
AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
AUTH_POST_LOGOUT_URI=http://localhost:5173/

# Secret used to derive the session cookie encryption key (any long random string)
SESSION_SECRET=change-me-to-a-long-random-string

# Optional session tuning (defaults shown)
# OIDC_SCOPE=openid profile email offline_access
# SESSION_TTL_SECONDS=604800
# SESSION_REFRESH_THRESHOLD_SECONDS=30
# AUTH_FLOW_TTL_SECONDS=600

# Backend API base URL (used from later parts)
API_BASE_URL=http://localhost:5111