.env.example

# Example-local .env template — `make run` copies this file to .env on first
# run. Pre-populated with dev-only placeholder values that match the tier-01
# example's defaults so the two examples work together out of the box.
#
# Companion: examples/_shared/.env.example is the production-shaped template
# (empty secrets, with `openssl rand -hex 32` hints) and is intended for
# operators copying the layout into their own deployment.
#
# Tier 02 depends on tier 01 (`examples/python/01-mcp-server-basic`) already
# being up. The admin API key below MUST match the value the tier-01
# authserver was started with so verify.sh can register the Mint resource
# and OAuth client against that running AS.

# Admin API bearer token for the privileged admin surface (:9001).
# generate: openssl rand -hex 32
AUTHPLANE_ADMIN_API_KEY=dev-admin-key-change-me

# Where the agent's SDK client should discover Authplane metadata + JWKS.
# Tier 01 advertises `http://authserver:9000` from inside Docker; the agent
# in this example runs on the host network, so it reaches the AS at
# `localhost:9000`. The SDK's `metadata.issuer == config.issuer` check
# (python-sdk/authplane/internal/metadata.py) means this value must equal
# the value tier 01's authserver was configured with, AS SEEN BY THE AGENT.
AUTHPLANE_ISSUER=http://authserver:9000

# Public base URL the protected MCP server advertises (used to derive both
# the JWT audience that the agent's token must carry and the URL the agent
# POSTs JSON-RPC at). Must match tier 01's `AUTHPLANE_BASE_URL`.
AUTHPLANE_BASE_URL=http://localhost:8080