{
  "version": "1.0.0",
  "production": true,
  "neverExposeOperatorKeyInBrowser": true,
  "portalInjectAuthViaNginx": true,
  "requireApiKeyAllExchangeRoutes": true,
  "customerAllowedScopes": ["read", "trade"],
  "superAdminOnlyScopes": ["settle", "token_load", "transfer", "admin"],
  "rateLimits": {
    "customerPerMinute": 30,
    "superAdminPerMinute": 120,
    "anonymousPerMinute": 0
  },
  "corsOrigins": [
    "https://secure.d-bis.org",
    "https://online.omdnl.org",
    "https://office24.omdnl.org",
    "https://digital.omdnl.org",
    "https://exchange.d-bis.org",
    "https://exchange.omdnl.org",
    "https://forex.omdnl.org"
  ],
  "publicEndpoints": [
    "/health",
    "/health/ledger",
    "/money-supply/public",
    "/public/money-supply"
  ],
  "notes": "Customer keys: OMNL_CUSTOMER_API_KEYS=key:read|trade or OMNL_CUSTOMER_API_KEY_1..3. Super-admin keys: OMNL_SUPER_ADMIN_*_KEY in config/omnl-super-admins.v1.json. Portal browsers use nginx-injected auth — never VITE_OMNL_API_KEY."
}
