.env.example

# Example-local .env template — `make run` copies this file to .env on first
# run. Pre-populated with dev-only placeholder values that match the tier-01
# example's defaults so the two examples work together out of the box.
#
# Companion: examples/_shared/.env.example is the production-shaped template
# (empty secrets, with `openssl rand -hex 32` hints) and is intended for
# operators copying the layout into their own deployment.
#
# Tier 02 depends on tier 01 (`examples/python/01-mcp-server-basic`) already
# being up. The admin API key below MUST match the value the tier-01
# authserver was started with so verify.sh can register the Mint resource
# and OAuth client against that running AS.

# Admin API bearer token for the privileged admin surface (:9001).
# generate: openssl rand -hex 32
AUTHPLANE_ADMIN_API_KEY=dev-admin-key-change-me

# Where the agent's SDK client should discover Authplane metadata + JWKS.
# Tier 01 runs the AS with issuer `http://localhost:9000` and the agent runs
# natively on the host, so the two agree. The SDK compares the metadata
# document's `issuer` with this value byte-for-byte, so it must equal what
# tier 01's authserver was configured with, AS SEEN BY THE AGENT.
AUTHPLANE_ISSUER=http://localhost:9000

# Public base URL the protected MCP server advertises (used to derive both
# the JWT audience that the agent's token must carry and the URL the agent
# POSTs JSON-RPC at). Must match tier 01's `AUTHPLANE_BASE_URL`.
AUTHPLANE_BASE_URL=http://localhost:8080