# Cloudflare credentials. Copy this file to .env and fill in real values,
# or run ./scripts/setup.sh for an interactive walkthrough. NEVER commit .env.

# API token (create at dash.cloudflare.com/profile/api-tokens).
# Required scopes:
#   Account: Workers Scripts (Edit), D1 (Edit), R2 (Edit),
#            Access: Apps and Policies (Edit), Pages (Edit),
#            Access: Organizations / IdP / Groups (Read)
#   Zone (the zone of PAGES_DOMAIN): DNS (Edit), Workers Routes (Edit)
CF_API_TOKEN=

# Your Cloudflare account ID (dashboard right sidebar; or `wrangler whoami`).
CF_ACCOUNT_ID=

# Filled in automatically by sync-access.ts after the Access app is created.
ACCESS_APP_ID=

# Roster sheet — published CSV export URL with an `email` column (currently
# expected at column index 3; see scripts/sync-access.ts:194). Leave blank to
# allow only the admins below.
ROSTER_CSV_URL=

# Comma-separated admin emails always added to the Access roster. Mirrors
# config.toml [project] admin_emails — keep these in sync.
ADMIN_EMAILS=you@example.com

# The hostname Cloudflare Access protects. Mirrors config.toml [public] host.
PAGES_DOMAIN=qa.example.com

# GitHub PAT with issues:write on the GH_FEEDBACK_REPO (see config.toml
# [project] gh_feedback_repo). Leave blank to disable the feedback button.
# Or push as a Worker secret: wrangler secret put GH_FEEDBACK_TOKEN
GH_FEEDBACK_TOKEN=