# Authentication
NEXTAUTH_URL=https://panel.example.com
NEXTAUTH_SECRET=generate-a-secret-here

# Keycloak SSO
KEYCLOAK_CLIENT_ID=control-panel
KEYCLOAK_CLIENT_SECRET=your-client-secret
KEYCLOAK_ISSUER=https://auth.example.com/realms/letsbe

# Orchestrator API (same server)
ORCHESTRATOR_URL=http://orchestrator:8100

# Tenant domain (set during provisioning)
TENANT_DOMAIN=example.com