.env.example

# ainfera-os — local dev environment.
# Copy to .env and source via Doppler in non-dev environments.

ENVIRONMENT=development

# Postgres (matches docker-compose.yml).
DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/ainfera_os

# L4 — HMAC secret for the audit chain. Rotate via Doppler in prod.
AUDIT_HMAC_SECRET=dev-only-rotate-in-doppler

# L1 — urlsafe-base64 of 32 raw bytes, used to encrypt Agent private keys at rest.
# Generate a new one with: python -c "import secrets,base64; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())"
# NOTE: the value below is an obvious 0x30-prefix placeholder ("0123456789abcdef…"
# base64-encoded). gitleaks may flag it via generic-api-key heuristic; it is NOT
# a real key. See tests/README.md for the legacy-fixture / placeholder catalog (AIN-144).
FERNET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=

# L1 — issuer + DID method used in JWS-signed AgentCards.
JWS_ISSUER=ainfera-os
DID_METHOD=did:ainfera
AGENT_CARD_TTL_DAYS=365

# L2 — provider API keys. Required at /v1/inference dispatch time.
ANTHROPIC_API_KEY=
OPENAI_API_KEY=
TOGETHER_API_KEY=
XAI_API_KEY=
GEMINI_API_KEY=
MISTRAL_API_KEY=