.env.example

# ── Sites (required) ─────────────────────────────────────────────────────────
# JSON array mapping friendly site ids to per-source identifiers.
# Shape: see sites.example.json. Keep the real mapping out of git — it names
# your properties, zones and projects even though it holds no secrets.
SITES_CONFIG=

# ── Google Analytics 4 — Data API, service account ───────────────────────────
# Full service-account JSON key as a single line. The service account must be
# added as a Viewer on each GA4 property referenced in SITES_CONFIG.
GA4_SERVICE_ACCOUNT_JSON=
# Local convenience for pnpm probe: path to the key file, read into
# GA4_SERVICE_ACCOUNT_JSON when that var is empty.
GA_SA_KEY_PATH=

# ── Cloudflare Web Analytics — GraphQL API ───────────────────────────────────
# API token with Account Analytics:Read (and Zone Analytics:Read for zones).
CLOUDFLARE_API_TOKEN=
# Account id for RUM/Web-Vitals datasets (accountTag scope).
CLOUDFLARE_ACCOUNT_ID=

# ── Vercel Analytics ─────────────────────────────────────────────────────────
# Vercel reserves the VERCEL_ prefix for its own system variables, so a
# deployment ON Vercel cannot define VERCEL_API_TOKEN — it is rejected as
# invalid. Use VC_API_TOKEN there. Both names work everywhere else.
VC_API_TOKEN=

# ── Google Search Console — service account ──────────────────────────────────
# May be the same key as GA4 if that service account was added in GSC.
# Leave empty to reuse GA4_SERVICE_ACCOUNT_JSON.
GSC_SERVICE_ACCOUNT_JSON=

# ── Cache (optional) ─────────────────────────────────────────────────────────
# When both are set, query results cache in Upstash Redis (REST). Otherwise an
# in-process memory cache is used — fine locally, useless across serverless
# isolates.
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# ── Change log (optional) ────────────────────────────────────────────────────
# The same Upstash credentials above also back the page history, under a
# separate 'hist:' keyspace. Without them page_changes reports that it has
# nothing recorded — the tools degrade, they do not fail.
#
# Secret Vercel sends as `Authorization: Bearer <value>` when it invokes the
# capture cron. REQUIRED for the cron to run: an unset secret is treated as
# closed, never as open. At least 16 random characters.
CRON_SECRET=

# ── Query (optional) ─────────────────────────────────────────────────────────
# Per-source fan-out timeout for `query` (ms). Default 10000.
QUERY_SOURCE_TIMEOUT_MS=
# Cache TTL for successful per-source query slots (seconds). Default 300.
QUERY_CACHE_TTL_S=

# ── Remote auth (HTTP transport only; stdio ignores these) ───────────────────
# Secret signing every token this server issues, plus the client registry HMAC.
# Rotating it invalidates all outstanding tokens and client registrations.
MCP_SIGNING_SECRET=

# The sign-in page that authenticates users and mints authorization codes. It
# lives in YOUR frontend, not in this repo — see README for the contract.
# No default: guessing one would send your users to someone else's login.
FRONTEND_URL=
# Path on FRONTEND_URL that renders it.
FRONTEND_AUTHORIZE_PATH=/auth/mcp-oauth

# Public origin of this deployment, advertised in OAuth metadata. Derived from
# the request host when unset, which is usually right on Vercel.
MCP_BASE_URL=
# Issuer/audience for tokens. Change only if you run several instances.
MCP_ISSUER=analytics-mcp

# Auth state (single-use codes, revocation). Reuses the Upstash vars above, or
# the KV_REST_API_* pair that Vercel's Upstash integration injects.
# REQUIRED in production: without it every token exchange fails closed —
# memory is for local development only.
AUTH_STATE_STORE=
# Key namespace in Redis. Defaults to MCP_ISSUER, which is usually right. Set
# it only if two servers share one Redis AND share an issuer — otherwise they
# share subject revocation, and revoking a user on one logs them out of both.
AUTH_STATE_PREFIX=

# Optional: also accept Clerk session JWTs as bearer tokens.
# CLERK_JWT_KEY alone is enough and is the safer setup — it is the PUBLIC PEM,
# so verification runs networklessly and this server never holds a credential
# that can mint or revoke sessions. Clerk Dashboard -> API keys -> Show JWT
# public key -> PEM Public Key.
CLERK_JWT_KEY=
# Only needed to verify over the network instead (fetches JWKS). Prefer the
# public key above.
CLERK_SECRET_KEY=
# Optional: restrict remote access to one email domain. Empty = no restriction.
ALLOWED_EMAIL_DOMAIN=

# ── Long-lived HTTP entry (pnpm serve) — not the default deploy path ─────────
# Only needed if you run the persistent-host entry instead of serverless.
# Without a token the server refuses to bind anything but loopback.
SERVE_BEARER_TOKEN=
HOST=127.0.0.1
PORT=8788