# ── Groq (required) ──────────────────────────────────────
GROQ_API_KEY=gsk_...

# ── Cohere (required for reranking, fallback to BM25 if missing) ──
COHERE_API_KEY=...

# ── Supabase (required) ───────────────────────────────────
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=eyJ...          # anon key (public — used for pgvector KB search)
SUPABASE_SERVICE_KEY=eyJ...  # service_role key (secret — used for analyses/chat tables)
SUPABASE_DB_URL=postgresql://postgres:password@db.your-project.supabase.co:5432/postgres

# ── Google Cloud Vision OCR (required for image OCR) ──────
GOOGLE_VISION_API_KEY=AIza...

# ── Frontend URL (CORS whitelist) ─────────────────────────
FRONTEND_URL=https://your-app.vercel.app

# ── Supabase Auth (required for protected API endpoints) ──
# Find in: Supabase Dashboard → Project Settings → API → JWT Secret
SUPABASE_JWT_SECRET=your-supabase-jwt-secret

# ── Environment ───────────────────────────────────────────
ENVIRONMENT=production

# ── Sentry (optional) ─────────────────────────────────────
SENTRY_DSN=https://...@sentry.io/...

# ── HuggingFace (optional — for higher rate limits) ───────
HF_TOKEN=hf_...