.env.example

# Secrets only. Never commit a real .env file.

# Port the server listens on (optional, defaults to 3000).
PORT=3000

# Path to the non-secret config file (optional, defaults to ./config.json).
COMMERCE_CONFIG=./config.json

# Optional SQLite file paths. Default is in-memory (carts/sessions lost on restart).
# CART_DB=./data/carts.sqlite
# SESSION_DB=./data/sessions.sqlite
# IDEMPOTENCY_DB=./data/idempotency.sqlite

# Stripe. Leave STRIPE_SECRET_KEY empty to run with the mock provider (no charges).
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=

# ACP REST auth. The bearer token an agent presents. Required for the ACP
# checkout endpoints to accept requests. The signing secret is optional and
# enables HMAC request-signature verification.
ACP_BEARER_TOKEN=
ACP_SIGNING_SECRET=

# Optional secret used to sign the order webhook payload we POST to the merchant.
ORDER_WEBHOOK_SECRET=