coracle/caravel
1
1
Fork 2
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

chore: encrypt tenant NWC URL at rest and stop secret exposure in tenant APIs

Browse Source
This commit is contained in:
Aditya Chaudhary
2026-05-05 18:58:16 +05:45
parent b1e3747ddb
commit 95f9f0c0bf
9 changed files with 86 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/README.md
+1
View File
@@ -44,6 +44,7 @@ Environment variables:
| `LIVEKIT_API_KEY` | LiveKit API key sent to zooid | _optional_ |
| `LIVEKIT_API_SECRET` | LiveKit API secret sent to zooid | _optional_ |
| `NWC_URL` | Platform NWC URL used to generate BOLT11 invoices | _required for invoice generation_ |
| `ENCRYPTION_SECRET` | Nostr secret key (hex or nsec) used to encrypt tenant NWC URLs at rest | _required_ |
| `STRIPE_SECRET_KEY` | Stripe API secret key used for billing API operations | _required_ |
| `STRIPE_WEBHOOK_SECRET` | Stripe webhook signing secret used to verify `Stripe-Signature` headers | _required_ |
| `ROBOT_SECRET` | Robot Nostr secret key | _required_ |