Files
OSIT-AE-App-Svelte/.env.staging.default
Scott Idem f03627ef3c security: move hardcoded bootstrap API key to env var
PUBLIC_AE_BOOTSTRAP_KEY replaces the hardcoded 'IDF68Em5X4HTZlswRNgepQ' in:
- src/routes/+layout.ts (site-domain bootstrap request)
- src/routes/testing/+page.svelte (trace agent key)

Added to .env.staging, .env.prod, .env.local (gitignored), and updated
.env.staging.default / .env.prod.default with XXXX placeholders.
Key can now be rotated independently from the main API secret key.
2026-03-10 16:30:11 -04:00

29 lines
1.0 KiB
Plaintext

# One Sky IT's Aether Framework and System — STAGING / HOME DEV template
# Copy to .env.staging and fill in real values.
# AE_CFG_ID: 1=Default, 5=Home Dev, 7=Live Testing/Prod
# Shared config record (controls SMTP, API routing, external keys from DB)
AE_CFG_ID=5
# Aether API access
PUBLIC_AE_API_PROTOCOL=https
PUBLIC_AE_API_SERVER=dev-api.oneskyit.com
PUBLIC_AE_API_BAK_SERVER=test-api.oneskyit.com
PUBLIC_AE_API_PORT=443
PUBLIC_AE_API_PATH=
PUBLIC_AE_API_SECRET_KEY=XXXX
PUBLIC_AE_API_CRUD_SUPER_KEY=XXXX
# Bootstrap key: used only for the unauthenticated site-domain lookup on first load.
# Separate from the main API key — has limited permissions (no account_id required).
PUBLIC_AE_BOOTSTRAP_KEY=XXXX
PUBLIC_AE_NO_ACCOUNT_ID=No_Account_ID_Here
PUBLIC_AE_NO_ACCOUNT_ID_TOKEN=Nothing_to_see_here
# SvelteKit app config
AE_APP_NODE_PORT=3001
# Default demo/client context (set to the target account for this deployment)
PUBLIC_AE_ACCOUNT_ID=XXXX # OSIT = _XY7DXtc9MY
PUBLIC_AE_EVENT_ID=XXXX # OSIT = pjrcghqwert
PUBLIC_AE_SPONSORSHIP_CFG_ID=XXXX