# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key

# Supabase Service Role (for server-side operations like webhook handling)
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# WhatsApp Token Encryption (64 hex chars = 32 bytes for AES-256-CBC)
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY=your-64-char-hex-key-here

# Meta App Secret — REQUIRED. Used to verify the HMAC-SHA256 signature
# Meta attaches to inbound webhook POSTs. Without it, the webhook
# rejects every request. Find it at:
#   Meta for Developers → your app → App Settings → Basic → App Secret
META_APP_SECRET=your-meta-app-secret