.env.example

# --- Extractor service (production) ---

# Shared secret the web app must send as X-API-Key. Generate a long random value
# and set the SAME value as EXTRACTOR_API_KEY on the web app. Stops anyone hitting
# the extractor directly and bypassing the web quota.
EBS_API_KEY=change-me-to-a-long-random-string

# Lock CORS to your web origin (the browser never calls this directly, but keep it tight).
EBS_ALLOWED_ORIGINS=https://exportbankstatement.com

# Scratch dir for uploads (auto-deleted). Default is ./_work; /tmp is fine on Railway.
# EBS_WORK_DIR=/tmp/ebs-work

# Max upload size in bytes (default 15 MB).
# EBS_MAX_UPLOAD_BYTES=15728640