AUTH_SECRET=myauthsecret # generate with https://generate-secret.vercel.app/32 or openssl rand -hex 32 on unix-like