.env.example to .env. The API validates configuration at startup and loads package-local values before filling missing values from the monorepo root.
Core services
Chain indexing
Security and email
ADMIN_API_KEY and AUTH_TOKEN_PEPPER must contain at least 32 characters and must use non-development values in production. Session, pre-auth, password-reset, OTP expiry, attempt, and resend settings are independently configurable. Production must use EMAIL_PROVIDER=zoho-smtp with the required SMTP credentials; secrets belong in a secret manager, not source control.
Future Stellar/Soroban configuration
When implemented, introduce validated variables for network/passphrase, RPC/Horizon providers, allowlisted asset issuer/contract identities, deployed contract IDs, fee/resource limits, and signer references. Update.env.example in the same change. Never reuse testnet configuration in mainnet.