.env.example

# Latch Configuration

# Azure AD Client ID (from app registration)
LATCH_CLIENT_ID=your-client-id-here

# Azure AD Tenant ID
LATCH_TENANT_ID=your-tenant-id-here

# Azure AD Client Secret (OPTIONAL - only for confidential clients)
# If omitted, uses PKCE (public client flow) - no secret needed
# If provided, uses confidential client flow with client_secret
# IMPORTANT: Rotate every 6-12 months. See docs/AUTHENTICATION_SETUP.md
# LATCH_CLIENT_SECRET=your-client-secret-here

# Cloud environment: 'commercial' | 'gcc-high' | 'dod'
LATCH_CLOUD=gcc-high

# Scopes (space-separated)
# For GCC-High, use openid profile User.Read
LATCH_SCOPES=openid profile User.Read

# Redirect URI (must match app registration)
LATCH_REDIRECT_URI=http://localhost:3000/api/latch/callback

# Cookie encryption secret (generate with: openssl rand -base64 32)
LATCH_COOKIE_SECRET=your-32-byte-secret-here

# Optional: Enable debug logging
LATCH_DEBUG=false

# Example for Commercial Azure:
# LATCH_CLOUD=commercial
# LATCH_SCOPES=openid profile User.Read

# Example for DoD:
# LATCH_CLOUD=dod
# LATCH_SCOPES=openid profile User.Read