.env.example

# Core
SIGN_DB_PATH=./data/sign.db
# Provider used by default when no --provider flag is given. One of: dropbox|docusign|signwell|local.
# `local` is the fully-offline PAdES signer — no API keys, no signup. It's also
# the built-in default when this is unset. Switch to a hosted provider only when
# you need an external trust anchor (and fill in its credentials below).
SIGN_PROVIDER=local

# --- Dropbox Sign ---
DROPBOX_SIGN_API_KEY=
# Set to true while validating against Dropbox Sign test mode.
DROPBOX_SIGN_TEST_MODE=true
# Required for embedded signing via Dropbox Sign.
DROPBOX_SIGN_CLIENT_ID=

# --- DocuSign (JWT auth) ---
DOCUSIGN_INTEGRATION_KEY=
DOCUSIGN_USER_ID=
DOCUSIGN_ACCOUNT_ID=
DOCUSIGN_BASE_PATH=https://demo.docusign.net/restapi
DOCUSIGN_PRIVATE_KEY_PATH=./keys/docusign-private.key

# --- SignWell ---
SIGNWELL_API_KEY=
# Defaults to https://www.signwell.com/api/v1 when blank.
SIGNWELL_BASE_URL=https://www.signwell.com/api/v1
SIGNWELL_TEST_MODE=true
# Optional: dedicated webhook secret. Falls back to SIGNWELL_API_KEY when unset.
SIGNWELL_WEBHOOK_SECRET=
# Optional: signer email used for live SignWell smoke tests.
SIGNWELL_SMOKE_SIGNER_EMAIL=