DATABASE_URL=postgres://musicshare:musicshare@localhost:5447/musicshare
REDIS_URL=redis://localhost:6380
PORT=4000
# Where the web app lives (CORS + post-OAuth redirects)
WEB_URL=http://localhost:3737
# Public base URL of this API, used for OAuth redirect URIs.
# Spotify requires a loopback IP (not "localhost") for http redirect URIs.
API_PUBLIC_URL=http://127.0.0.1:4000
COOKIE_SECURE=false
# 32 random bytes, base64. Generate with: openssl rand -base64 32
TOKEN_ENCRYPTION_KEY=

# https://developer.spotify.com/dashboard  (redirect URI: $API_PUBLIC_URL/connections/spotify/callback)
SPOTIFY_CLIENT_ID=
SPOTIFY_CLIENT_SECRET=
# https://www.last.fm/api/account/create
LASTFM_API_KEY=
# Shared secret from the same Last.fm API account; enables one-tap "Sign in with Last.fm"
LASTFM_SHARED_SECRET=
# song.link API key (request at https://odesli.co). Enables YouTube Music/TIDAL links; without it those fall back to search.
ODESLI_API_KEY=
# Lyrics source: LRCLIB (open source; run your own and point this at it). Empty turns lyrics off.
LRCLIB_URL=https://lrclib.net
# Stable identifier for this app in Plex's auth flow
PLEX_CLIENT_ID=musicshare-dev
# Let users connect Jellyfin/Plex servers on private networks (LAN). Never enable in a hosted deployment.
ALLOW_PRIVATE_SERVER_URLS=false
# Apple Music: Apple Developer → Certificates, IDs & Profiles → Keys → new key with MusicKit enabled.
# Paste the .p8 contents with newlines as \n.
APPLE_TEAM_ID=
APPLE_MUSICKIT_KEY_ID=
APPLE_MUSICKIT_PRIVATE_KEY=

# Outgoing email (verification, password reset). SMTPS on 465.
SMTP_HOST=
SMTP_PORT=465
SMTP_USER=
SMTP_PASSWORD=
MAIL_FROM=musicshare <app@musicshare.binarygnome.com>