// Local (non-versioned) config for API keys.
// Copy this file to `assets/config.local.js` and fill in your keys.
// IMPORTANT: Restrict keys in their provider consoles (HTTP referrers, APIs enabled).
//
// SECURITY NOTE: everything set here is shipped to the browser. Only put
// browser-safe, referrer-restricted keys in this file. Server-only secrets
// (TWITCH_CLIENT_SECRET, GEMINI_API_KEY, JWT_SECRET...) must be provided via
// environment variables on the backend instead — the app consumes them through
// /api/twitch-token and /api/ai/* endpoints.

// YouTube Data API v3 key (browser-safe only if properly restricted by HTTP referrer)
window.YOUTUBE_API_KEY = 'PUT_YOUR_YOUTUBE_API_KEY_HERE';

// Optional: you can also provide multiple keys (CSV) via server env YOUTUBE_API_KEYS.

// Rumble API key (optional — Rumble now works via server-side scraping)
// window.RUMBLE_API_KEY = 'PUT_YOUR_RUMBLE_API_KEY_HERE';

// Odysee: no API key is required when using the built-in proxy.

// Twitch: configured via server env (TWITCH_CLIENT_ID / TWITCH_CLIENT_SECRET).
// Gemini: configured via server env (GEMINI_API_KEY).

// You can add other browser-safe provider keys/tokens here if needed in the future.