# Schwab Developer Portal credentials for schwab-positions-mcp.
# Get these from: https://developer.schwab.com/dashboard/apps
#
# IMPORTANT:
#   * Copy this file to `.env` (which is git-ignored) before editing.
#   * Replace the `dummy-not-a-real-secret` placeholders with the real
#     values printed in your Schwab Developer Portal app dashboard.
#   * Never commit `.env`. pre-commit (gitleaks + detect-secrets) will
#     block such commits when the hooks are installed.
#   * This MCP server is READ-ONLY by design — see docs/SECURITY.md.
#     Schwab's OAuth `trade` scope is mandatory for the underlying
#     positions / orders / transactions endpoints, but every mutation
#     call is blocked at the code layer.

SCHWAB_API_KEY=dummy-not-a-real-secret  # pragma: allowlist secret
SCHWAB_APP_SECRET=dummy-not-a-real-secret  # pragma: allowlist secret

# This MUST exactly match the redirect URI registered in the Schwab
# Developer Portal app. schwab-py defaults to https://127.0.0.1:8182.
# If this value does not byte-for-byte match the redirect URI registered
# in your Schwab Developer Portal app (scheme, host, port, trailing
# slash), the OAuth flow will fail with MismatchingStateException
# ("CSRF Warning!") after you click Allow.
SCHWAB_CALLBACK_URL=https://127.0.0.1:8182

# Optional: override token storage path (default:
# ~/.config/schwab-positions-mcp/token.json).
# SCHWAB_POSITIONS_TOKEN_PATH=

# Optional: derived-history cache (default: DISABLED / opt-in).
# Persists read-only snapshots (positions / orders / transactions) so an
# agent can run "what changed since last week" queries without re-hitting
# Schwab. OFF by default. Enable it explicitly:
# SCHWAB_POSITIONS_CACHE_ENABLED=true
# Set to bypass reads while still writing (rarely needed):
# SCHWAB_POSITIONS_CACHE_BYPASS=0

# Optional: pluggable cache backend (default: memory).
#   memory     — in-process, zero external dependency (default). Keeps no
#                durable history (snapshot writes report 0 persisted rows).
#   clickhouse — durable derived-history persistence; requires the extra
#                `pip install schwab-positions-mcp[clickhouse]` + a reachable
#                ClickHouse. Falls back to memory on any unknown value.
# SCHWAB_POSITIONS_CACHE_BACKEND=memory
# SCHWAB_POSITIONS_CLICKHOUSE_URL=clickhouse://user:pass@host:8123/db  # pragma: allowlist secret

# Optional: stderr log level (default: WARNING).
# LOG_LEVEL=WARNING