.dev.vars.example

# Binding names only. Keep real local values in .dev.vars (gitignored).
NUXT_SESSION_PASSWORD=
NUXT_ADMIN_SECRET=
NUXT_TOKEN_KEY=
NUXT_HEALTH_CHECK_NOTIFY_TO=
NUXT_PUBLIC_SITE_URL=
NUXT_OAUTH_GITHUB_CLIENT_ID=
NUXT_OAUTH_GITHUB_CLIENT_SECRET=
# Signs OG image URLs. At least 32 characters: pnpm exec nuxt-og-image generate-secret
NUXT_APP_SECRET=
# Signs same-origin image proxy addresses. Keep it separate from NUXT_TOKEN_KEY.
NUXT_IMAGE_PROXY_KEY=
NUXT_AI_READY_RUNTIME_SYNC_SECRET=
# Every Worker GitHub read uses the read App (SKILLD_READ_APP_*): metadata read
# only, installed on skilld-dev, with a quota nothing else spends. The key is a
# PKCS #8 PEM. Without the App secrets, as in local development, reads use
# GITHUB_TOKEN.
#
# With the App set, GITHUB_TOKEN is a fallback only: it repeats a read GitHub
# denied the App, such as an organization that restricts Apps. Builds try
# ARTIFACT_GITHUB_TOKEN first. Each fallback read is logged as an app-denied event.
# Both may stay empty.
GITHUB_TOKEN=
ARTIFACT_GITHUB_TOKEN=
SKILLD_READ_APP_ID=
SKILLD_READ_APP_INSTALLATION_ID=
SKILLD_READ_APP_PRIVATE_KEY_PKCS8=
ARTIFACT_PRIVATE_ACCESS_ENABLED=false
GITHUB_APP_ID=
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=
GITHUB_APP_PRIVATE_KEY_PKCS8=
GITHUB_APP_WEBHOOK_SECRET=
ARTIFACT_KEY_WRAP_KEY_PRIMARY=
ARTIFACT_KEY_WRAP_KEY_SECONDARY=
ARTIFACT_GRANT_IDEMPOTENCY_KEY=
# Public verification material. The signer keeps private keys in its Worker.
ARTIFACT_TRUSTED_ROOT_JSON=
ANTHROPIC_API_KEY=
VOYAGE_API_KEY=
X_BEARER_KEY=
# Bluesky discovery. Optional: search works unauthenticated, but the public
# AppView throttles after roughly fifteen requests, so production wants these.
# BSKY_APP_PASSWORD is an app password (bsky.app/settings/app-passwords), never
# the account password.
BSKY_IDENTIFIER=
BSKY_APP_PASSWORD=
DISCORD_WEBHOOK_URL=