Configuration¶

Backend configuration is loaded by pydantic-settings from environment variables and backend/.env. Flutter accepts non-secret compile-time values through --dart-define.

Safe configuration workflow¶

cp backend/.env.example backend/.env

Then edit only backend/.env. Do not add provider secrets to:

Flutter source files
--dart-define
Markdown documentation
screenshots, logs, issues, or pull requests
shell history shared with other users

Required for a local UI preview¶

The backend defaults to SQLite and can start with blank provider settings:

APP_ENV=development
DATABASE_URL=sqlite+pysqlite:///./eakto.db
CORS_ORIGINS=http://localhost:8001,http://127.0.0.1:8001

When Flutter runs on another port, update CORS_ORIGINS to the exact origin. Wildcard CORS is rejected.

Provider groups¶

Group	Variables	Secret boundary
eGovAI	`EGOV_AI_BASE_URL`, `EGOV_AI_ACCESS_CODE`, generation and threshold settings	Access code is backend-only
eGovPH SSO	`EGOVPH_SSO_BASE_URL`, `EGOVPH_SSO_PARTNER_CODE`, `EGOVPH_SSO_PARTNER_SECRET`	Partner secret is backend-only
eVerify	`EVERIFY_BASE_URL`, client ID, client secret, public key, identity-reference secret	Client and reference secrets are backend-only; public SDK key may be returned safely
Face Liveness	Base URL, API key, callback URL, confidence threshold	API key is backend-only
Supabase	Project URL, service key, database URL, private bucket and table	Service key and database URL are backend-only

Use the Configuration reference for every supported variable and default.

Flutter API URL¶

The default URL depends on the target:

Web and desktop: http://localhost:8000/api/v1
Android emulator: http://10.0.2.2:8000/api/v1

Override it when needed:

flutter run -d chrome \
  --web-port 8001 \
  --dart-define=API_BASE_URL=http://localhost:8000/api/v1

API_BASE_URL is not a secret.

Restricted integration specifications¶

Some provider contracts used during the hackathon are available only to authorized participants. This repository’s docs intentionally do not reproduce private credentials, dashboard values, full partner specifications, or sensitive sample payloads. Team members should retrieve those details from the authorized eGovPH channels and map them to the environment variables above.

Never commit .env or PEM files

backend/.env and backend/everify-public.pem are ignored. Before pushing, run git status --short --untracked-files=all and verify that no credential artifact appears.