# ============================================================
# Bexley Podiatry — form API secrets (LIVE)
# This file is gitignored AND blocked from HTTP access by .htaccess.
# Never commit real secrets. Edit these values on the server.
# ============================================================

# ----- reCAPTCHA v3 -----
# While this starts with "YOUR_", server-side verification is BYPASSED
# so the endpoint works before the real key is wired in. Replace with the
# real v3 SECRET key to switch verification on.
RECAPTCHA_SECRET=YOUR_RECAPTCHA_SECRET_KEY_HERE
RECAPTCHA_MIN_SCORE=0.5

# ----- Mail addressing -----
RECIPIENT_EMAIL=info@bexleypodiatry.com.au
SENDER_EMAIL=no-reply@bexleypodiatry.com.au
SENDER_NAME="Bexley Podiatry Website"

# Optional CC / BCC — comma-separated. Leave blank to disable.
MAIL_CC=
MAIL_BCC=

# ----- Branding -----
LOGO_URL=https://api.bexleypodiatry.com.au/logo.png

# ----- CORS -----
# Production origins + localhost for local dev testing. Lock down in prod.
ALLOWED_ORIGINS=https://bexleypodiatry.com.au,https://www.bexleypodiatry.com.au,https://test.bexleypodiatry.com.au,http://localhost:3000,http://localhost:3001
