.env.example

# OBP API Configuration
OBP_BASE_URL="http://localhost:8080"
OBP_API_VERSION="v7.0.0"

# Basic Server Config
FASTMCP_PORT=9101
FASTMCP_HOST=0.0.0.0

# OAuth Settings
ENABLE_OAUTH="false"

## this is the url of this mcp application i.e. http://localhost:9100
BASE_URL="http://localhost:9101"

# Choose authentication provider:
#   - "bearer-only": Simple JWT validation only (recommended for Opey/internal agents)
#                    OAuth flow is handled externally; MCP server just validates tokens
#   - "obp-oidc":    Full OAuth 2.1 flow with OBP-OIDC (for external MCP clients)
#   - "keycloak":    Full OAuth 2.1 flow with Keycloak (for external MCP clients)
#
# For Opey: Use "bearer-only" - the frontend portal handles OAuth, and the agent
#           passes the user's token to the MCP server for validation.
# For VS Code/Claude Desktop: Use "obp-oidc" or "keycloak" - these clients need
#           the full OAuth discovery flow to authenticate users.
AUTH_PROVIDER=obp-oidc

## Keycloak realm URL (required if AUTH_PROVIDER=keycloak)
## For bearer-only: Set this to accept tokens from Keycloak
#KEYCLOAK_REALM_URL="http://localhost:8000/realms/obp-mcp"

# OBP-OIDC issuer URL (required if AUTH_PROVIDER=obp-oidc)
# For bearer-only: Set this to accept tokens from OBP-OIDC
OBP_OIDC_ISSUER_URL=http://localhost:9000/obp-oidc

# This setting controls how we authorize API requests to OBP after authentication.
# Options:
#   - "oauth":  Use OAuth the oauth access token. Best for when using an MCP client that cannot perform the 
#               consent flow itself (e.g. VS Code extension, Claude Desktop).
#   - "consent": Elicit user consent before each API call. Best for MCP clients like Opey that will support
#               user consent flows.
#   - "none":   No authorization method is used. OBP-API calls are made but with limited access (only public endpoints).
OBP_AUTHORIZATION_VIA="none" # Options: "oauth", "consent", "none"

# OBP API consumer key that opey uses (required for "consent" authorization method with opey)
OBP_OPEY_CONSUMER_KEY="obp-opey-ii-client"

# Multi-issuer bearer-only mode:
# Set BOTH KEYCLOAK_REALM_URL and OBP_OIDC_ISSUER_URL with AUTH_PROVIDER=bearer-only
# to accept tokens from either identity provider. The server will route validation
# to the correct JWKS endpoint based on the token's "iss" claim.
#
# Example for multi-issuer:
#   AUTH_PROVIDER=bearer-only
#   KEYCLOAK_REALM_URL=http://localhost:8080/realms/fastmcp
#   OBP_OIDC_ISSUER_URL=http://localhost:9000/obp-oidc

# Optional: Override JWKS URI for single-issuer bearer-only mode
# (defaults to {issuer}/jwks for OBP-OIDC or {issuer}/protocol/openid-connect/certs for Keycloak)
# JWKS_URI=http://localhost:9000/obp-oidc/jwks

# FastMCP Server Configuration
# These variables control the HTTP server host and port
FASTMCP_HOST="127.0.0.1"
FASTMCP_PORT="9100"

# Database Index Update Configuration
UPDATE_INDEX_ON_STARTUP="true"
# Options: "static", "dynamic", "all"
UPDATE_INDEX_ENDPOINT_TYPE="all"

# Periodic refresh interval in minutes (0 to disable)
REFRESH_INTERVAL_MINUTES="5"

# Options: "DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"
LOG_LEVEL="INFO"