.env.cloud.example

# The Cloud course: copy this file to .env (in the repo root) and fill it in
# from your instance on StreamNative Cloud. .env is git-ignored: never commit it.
#
#   cp .env.cloud.example .env
#
# labs/cloud/00-set-up.md, step 2, has the snctl command for each address.
# In an environment the organizers created for your team, the values come from
# your row in their environment sheet, and you create the API key yourself:
# labs/cloud/00-set-up-team-card.md, step 2.
# (The Local course writes its own .env: see labs/local/00-set-up.md.)

# -------------------------------------------------- from the organizers --

# Your service account's API key (API Key v2). It authenticates the hosted Agent
# Engine API, Kafka and Schema Registry. The MCP server uses a separate browser
# login, in Lab 3.
SN_API_KEY=

# Your service account's principal, used as the Kafka SASL username.
# Looks like: <service-account>@<org>.auth.streamnative.cloud
SN_SERVICE_ACCOUNT=

# ------------------------------------------------ from your instance --

# Your agent workspace's external endpoint, with https:// in front. Host root
# only, no /v1. Looks like: https://<host>
ORCA_BASE_URL=

# Your Kafka cluster's external endpoint, with its port (host:9093), and its
# schema registry's external endpoint, with https:// in front.
KAFKA_BOOTSTRAP_SERVERS=
SCHEMA_REGISTRY_URL=

# Your SQL workspace's MCP route (the agent's data tools):
# https://mcp.streamnative.cloud/mcp/x/<org>/sqlworkspace.compute.streamnative.io/<SQL workspace>
SN_MCP_URL=

# The SQL catalog/database used in Labs 2-4, not the SQL workspace name.
# Set this to the catalog NAME whose sourceRef names your Kafka cluster.
# Agent construction scopes all SQL instructions to this database. Leaving it
# empty keeps legacy automatic discovery; set it when a workspace has multiple databases.
# This is prompt guidance, not an MCP authorization boundary.
SN_SQL_DATABASE=

# MCP authentication: oauth (default) or static_bearer for API-key MCP servers.
# All three paths call ork for the first OAuth login, then reuse the
# credential stored in the vault. Needs ork v0.6.0 or newer.
SN_MCP_AUTH=oauth

# Optional authorization server selection. Leave empty for automatic discovery.
# If multiple servers are advertised, copy one exact authorization_servers value
# from the MCP protected-resource metadata; do not substitute the metadata issuer.
SN_MCP_OAUTH_ISSUER=
SN_MCP_OAUTH_SCOPE="openid profile email offline_access"

# ------------------------------------------------------------- your choices --

# The Kafka topic you create and load in Lab 0. The seeder, the injector and the
# doctor read this value. Your SQL catalog imports the topic as a source with the
# same name, and the SQL files in sql/cloud/ use the default below: if you change
# it, change the quoted source name in them too. SQL Workspace does not read .env.
LOGIN_TOPIC=security.login_events

# The model your agent runs on (served by the Agent Engine's AI gateway).
ORCA_MODEL=claude-sonnet-4-6

# Names your agent, environment, and vault. Defaults to your OS user name.
PARTICIPANT=