# Production secrets/configuration (do not commit real values)
DJANGO_DEBUG=0
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
DJANGO_ALLOWED_HOSTS=academy.example.com

# ZarinPal REST API v4
ZARINPAL_MERCHANT_ID=replace-with-your-merchant-id
ZARINPAL_SANDBOX=0
# Used only when sandbox is enabled; never use the production merchant here.
ZARINPAL_SANDBOX_MERCHANT_ID=00000000-0000-0000-0000-000000000000
# Must exactly match the domain registered for the ZarinPal terminal.
PAYMENT_CALLBACK_BASE_URL=https://academy.example.com

# OTP provider
OTP_BACKEND=webhook
OTP_WEBHOOK_URL=https://sms-provider.example.com/otp
OTP_WEBHOOK_TOKEN=replace-with-provider-token
OTP_TEMPLATE=academy-login
