<!-- generated: core@952f0b50f0bc · region: com · lang: en — do not edit directly -->

# Configuration Templates

> Reference file for the Autional Onboarding skill.
> Fill the `{BRACED}` fields per project; the rest is already region-correct.

## src/autional.ts (React example)

```ts
/**
 * Autional config — generated by the Autional onboarding procedure
 * Date: {DATE}
 * Framework: {FRAMEWORK}
 */

import { AutionalProvider, useAutional, RequireAuth } from '@autional/react';

export const autionalConfig = {
  appId: '{APP_ID}',
  issuer: 'https://api.autional.com',
  apiUrl: 'https://api.autional.com/bff',
  tenantSlug: '{TENANT_SLUG}',
  syncTabs: true, // keep — cross-tab session sync (refresh/logout broadcast)
};

// Same-origin proxy form (apiUrl on your own origin, e.g. a /bff reverse proxy)?
// The default authorize URL only rewrites an "api." host into "auth." — any other host
// carries through and lands on the API plane, which serves no login UI. Pin the auth plane:
//   await autional.loginWithOAuth({
//     authorizeUrl: 'https://auth.autional.com/oauth/api/v1/oauth/authorize',
//   });

export { AutionalProvider, useAutional, RequireAuth };
```

Vue: `import { createAutional } from '@autional/vue'` → `app.use(createAutional(autionalConfig))`.
Next.js: wrap the root layout with the provider from `@autional/next` and protect routes via its middleware export.

## .env (public — safe to commit)

```env
# Autional — public configuration (safe to commit)
AUTIONAL_APP_ID={APP_ID}
AUTIONAL_ISSUER=https://api.autional.com
AUTIONAL_API_URL=https://api.autional.com/bff
AUTIONAL_TENANT_SLUG={TENANT_SLUG}   # your tenant slug — portal links & SDK tenantSlug
```

Use the framework's public prefix when needed: `VITE_` (Vite), `NEXT_PUBLIC_` (Next.js), `REACT_APP_` (CRA); none for Node.

## .env.local (private — never commit)

```env
# Autional — private notes (gitignored automatically)
# Created: {DATE}
# Admin email: {ADMIN_EMAIL}
# Admin password: stored separately, NOT in this file
```

## AUTIONAL_SETUP.md template

```markdown
# Autional Integration — {PROJECT_NAME}

## Basics
- Date: {DATE}
- Framework: {FRAMEWORK}
- Tenant: {TENANT_NAME}
- Tenant slug: {TENANT_SLUG}
- Region: .com
- Environment: {ENVIRONMENT}

## Configuration
- App ID: {APP_ID}
- Issuer: https://api.autional.com
- API URL: https://api.autional.com/bff
- Admin: {ADMIN_EMAIL}

## Security policy
- Password transmission: {PASSWORD_TRANSMISSION}
- Min length: {MIN_LENGTH}
- Requirements: {REQUIREMENTS}
- MFA: {MFA_STATUS}
- Breached-password check: {BREACHED_CHECK_STATUS}

## Test accounts
| Account | Password | Role |
|---|---|---|
| {TEST1_EMAIL} | {TEST1_PASSWORD} | test user 1 |
| {TEST2_EMAIL} | {TEST2_PASSWORD} | test user 2 |
| {TEST3_EMAIL} | {TEST3_PASSWORD} | test user 3 |

> Test passwords are shown once; reset them in the admin portal afterwards.

## Portals
| Portal | Address | Purpose |
|---|---|---|
| Admin | https://admin.autional.com/{TENANT_SLUG}/ | users / roles / security policy / audit log |
| User | https://user.autional.com/{TENANT_SLUG}/ | change password / devices / MFA |
| Security | https://security.autional.com/{TENANT_SLUG}/ | anomaly detection / login trends |
| Developer | https://developer.autional.com | API docs / OAuth clients / app settings (global) |
| Status | https://status.autional.com | service health (global) |

> Console portals are tenant-scoped — the slug keeps users on their tenant. A bare root drops them on the tenant picker.

## Reminders
1. Admin password stored separately (not in this file)
2. .env.local is gitignored
3. Check the developer portal after upgrades for new security features
```