# Copy to .env and fill in. Never commit .env.

# From @BotFather — the full token, e.g. 1234567890:AAH....
TELEGRAM_BOT_TOKEN=

# Comma-separated Telegram chat ids that receive every OTP.
# Each of these users MUST have sent the bot at least one message first
# (Telegram forbids a bot from opening a conversation).
# Discover them with:  GET http://localhost:5010/chat_ids  (with the X-Api-Key header)
TELEGRAM_CHAT_IDS=

# REQUIRED. Shared secret the caller must send as the `X-Api-Key` header.
# Minimum 16 chars; the process refuses to start without it.
# Generate one:  node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"
# The same value goes into the .NET side's Seams:Sms:Telegram:ApiKey (user-secrets, never committed).
API_KEY=

# HTTP listener
PORT=5010
HOST=127.0.0.1

# Set to `true` to keep the OTP code out of this process's stdout logs.
# The code is still delivered over Telegram either way.
REDACT_CODE_IN_LOGS=false

# api.telegram.org is filtered in Iran. On Node 24+, these two make the built-in fetch
# use your local proxy; point HTTPS_PROXY at whatever your VPN/proxy client listens on.
# NODE_USE_ENV_PROXY=1
# HTTPS_PROXY=http://127.0.0.1:10809