<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Check-in pass secret
    |--------------------------------------------------------------------------
    |
    | The pepper the rotating member pass is derived from. Deliberately NOT
    | APP_KEY: APP_KEY decrypts sessions and cookies, and a check-in secret does
    | not deserve that blast radius — if one leaks the other must survive.
    |
    | 32 bytes minimum. CheckInTokenService refuses to issue or verify anything
    | without it rather than falling back to a weaker key, because a pass that
    | anyone can forge is worse than no pass at all.
    |
    | Generate with: php -r "echo bin2hex(random_bytes(32));"
    |
    */

    'checkin_pepper' => env('CHECKIN_PEPPER', ''),

];
