.env.example

# === Base URLs ===
HOLA_BASE_URL=http://localhost:8087
OBP_PORTAL_BASE_URL=http://localhost:5174
API_MANAGER_BASE_URL=http://localhost:3003

# === OIDC software (picked on the API Manager login page) ===
# Identifies WHICH OIDC provider implementation to delegate to (e.g. "obp-oidc").
OIDC_LOGIN_PROVIDER=obp-oidc

# === OBP-OIDC Login Credentials ===
OBP_LOGIN_USERNAME=
OBP_LOGIN_PASSWORD=

# === VRP Form: Bank & Account Routing ===
VRP_FROM_BANK_ROUTING_ADDRESS=
VRP_FROM_ROUTING_ADDRESS=
VRP_TO_ROUTING_ADDRESS=
VRP_CURRENCY=EUR

# === VRP Form: Limits (defaults provided) ===
VRP_MAX_SINGLE_AMOUNT=100
VRP_MAX_MONTHLY_AMOUNT=1000
VRP_MAX_MONTHLY_FREQUENCY=10
VRP_MAX_YEARLY_AMOUNT=10000
VRP_MAX_YEARLY_FREQUENCY=100
VRP_MAX_NUMBER_OF_HISTORICAL_CONSENTS_SHOWN=10

# === Powerful user (has entitlements to create banks, grant entitlements, etc.) ===
POWERFUL_USER_1_USERNAME=TheSuperUserAForTesting
POWERFUL_USER_1_PASSWORD=
# Credentials provider — picked from the dropdown on the OBP-OIDC login page.
# Identifies WHERE this user's credentials are stored (an OBP-API host, a URL fragment, etc.)
# The value is matched as a case-insensitive substring against dropdown option labels.
# If unsure check your OBP authuser database table for a field called provider.
# Typically it has the value of the OBP API host. (i.e. not a Google URL)
POWERFUL_USER_1_CREDENTIALS_PROVIDER=http://127.0.0.1:8080

# === Mailpit (email testing) ===
MAILPIT_API_URL=http://localhost:8025

# === OTP for consent challenge ===
TEST_OTP_VALUE=123456

# === Rate-limit bypass ===
# Must match RATE_LIMIT_BYPASS_TOKEN in OBP-Frontend (api-manager + portal).
# When set, every request Playwright makes carries a `Rate-Limit-Bypass-Token`
# header with this value, which skips the limiter server-side. Leave blank in
# environments where the backend doesn't have a matching token configured.
RATE_LIMIT_BYPASS_TOKEN=