.env.example

# Primary Postgres connection string used by the app (string).
# Example value points to a local DB; replace with production DSN in deploys.
DATABASE_URL=postgresql://stargate:pass@localhost:5432/stargate

# Postgres DSN used by tests (string). Keep separate to avoid clobbering prod DB.
DATABASE_URL_TEST=postgresql://stargate:pass@localhost:5432/stargate_test

# Redis URL for caching/locks (string). Default example: local Redis.
REDIS_URL=redis://localhost:6379

# JWT signing secret (string). Must be high-entropy and >= 32 characters.
JWT_SECRET=minimum-32-chars-high-entropy-secret

# Access token lifetime (string, duration). Examples: 15m, 1h, 1d.
JWT_EXPIRY=15m

# Refresh token lifetime (string, duration).
REFRESH_TOKEN_EXPIRY=7d

# Stellar network identifier (string): "testnet" or "public".
STELLAR_NETWORK=testnet

# Horizon URL for Stellar network RPC (string).
HORIZON_URL=https://horizon-testnet.stellar.org

# Soroban RPC endpoint (string) for smart contract interactions.
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org

# Asset code used on Stellar (string), e.g. USDC.
STELLAR_ASSET_CODE=USDC

# Issuer account for the Stellar asset (string, public key).
STELLAR_ASSET_ISSUER=G...

# Platform treasury public key (string, Stellar public key).
PLATFORM_TREASURY_PUBLIC_KEY=G...

# On-chain invoice contract identifier (string) when applicable.
INVOICE_CONTRACT_ID=C...

# AWS KMS key ARN used for encrypting secrets (string).
AWS_KMS_KEY_ID=arn:aws:kms:us-east-1:...

# AWS region for AWS services (string).
AWS_REGION=us-east-1

# 3rd-party risk API key (string) — e.g. TRM Labs.
TRM_LABS_API_KEY=...

# Enable OFAC screening (boolean: true/false).
OFAC_SCREENING_ENABLED=true

# Velocity limit per hour (integer, cents). Example: 5,000,000 = $50,000.00/hour.
VELOCITY_LIMIT_PER_HOUR_CENTS=5000000

# Platform fee in basis points (integer). 100 bps = 1%.
PLATFORM_FEE_BPS=50

# Platform fixed fee amount in USDC (decimal string).
PLATFORM_FEE_FIXED_USDC=0.25

# Default webhook signing secret used for local testing (string).
# In production, secrets are generated per-webhook and stored securely.
WEBHOOK_SIGNING_SECRET=high-entropy-secret

# Number of webhook delivery retry attempts (integer).
WEBHOOK_MAX_RETRIES=5

# Timeout for webhook delivery HTTP requests in milliseconds (integer).
WEBHOOK_TIMEOUT_MS=5000
WEBHOOK_JITTER_MAX_MS=30000

# Reconciler gRPC server port (integer).
RECONCILER_GRPC_PORT=50051

# Reconciler status HTTP port (integer).
RECONCILER_STATUS_PORT=9090

# Reconciler cursor starting position (string). Use "now" or a timestamp/tx id.
RECONCILER_CURSOR=now

# Application HTTP port (integer).
PORT=3001

# S3 bucket used to store KYC documents (string).
KYC_S3_BUCKET=stargate-kyc-documents