Configuration
keys, settings, publishing.

01Three places, one rule

02App keys (.env)

cd crypto_wallet
cp .env.example .env
# every run and build then adds:
flutter run --dart-define-from-file=.env

Leave these empty. They are in .env.example but this version does not use them: TENDERLY_*, INFURA_API_KEY, QUICKNODE_*, OPENSEA_API_KEY, FCM_SERVER_KEY, MIXPANEL_TOKEN, AMPLITUDE_API_KEY, FORCE_ENABLE_*, FORCE_DEBUG_LOGGING, APP_ENV, FEE_WALLET_ADDRESS, FEE_BPS. The fee is set in the admin, not here. CLAUDE_API_KEY must never be in the app's .env; it is a backend secret.

Without keys

03Backend settings (functions/.env)

Read by the Cloud Functions at deploy time. Never shipped inside the app. The provider accounts behind these keys (Apple, Google, Anthropic) and your Firebase Blaze plan are your own, and they may charge usage fees that you pay.

Portfolio Brain limits

callPortfolioBrain answers only callers that have an active, paid PRO plan verified by the server (store purchase, crypto payment or admin grant; the free trial does not include Portfolio Brain) and a valid App Check token, and it accepts structured portfolio data only, never a free-text prompt (questions are capped at 500 characters). Two daily caps in functions/.env bound your Anthropic bill; counters are kept per UTC day in the _ai_usage_daily collection.

App Check

The app activates Firebase App Check right after Firebase starts (lib/core/firebase/app_check_service.dart). Portfolio Brain needs it; nothing else depends on it.

1. Register your appsIn App Check (Firebase guide) register Play Integrity for Android (add your release SHA-256 fingerprint in the project settings), App Attest for iOS and macOS (DeviceCheck is the fallback), reCAPTCHA v3 for the web.
2. iOS: App Attest capabilityApp Attest works only when the app is signed with the App Attest entitlement. ios/Runner/Runner.entitlements already contains com.apple.developer.devicecheck.appattest-environment (production; the debug file uses development). In Xcode open ios/Runner.xcworkspace → Runner target → Signing & Capabilities and check that App Attest is listed (add it with + Capability if it is not), so it is also enabled on your App ID and in your provisioning profile. Without it, iOS release builds get no App Check token and Portfolio Brain falls back to its on-device summary.
3. Web site keyBuild the web app with --dart-define=APP_CHECK_WEB_RECAPTCHA_SITE_KEY=<your site key>. Without it App Check stays off on the web and Portfolio Brain falls back to its on-device summary there.
4. Debug buildsDebug builds use the debug provider: run once, copy the debug token from the console log into App Check as a debug token (Firebase: debug provider).

cd crypto_wallet
firebase functions:secrets:set OWNER_UID
firebase deploy --only functions      # after every change to functions/.env or a secret

04Runtime config: how a change reaches phones

1. SaveEach admin page has its own save button (Apply Fee Config, Save Branding…). Saving writes to Firestore (app_config/runtime_admin_config) and updates the live /config.json at once.
2. PublishPublish to mobile app (bottom-right of every page) calls publishAdminRemoteConfig, which updates the admin_config value in Firebase Remote Config.
3. Users get itRelease builds fetch Remote Config at most once an hour; debug builds on every start. An open app also applies Remote Config's live updates. The config.json copy is refreshed in the background on each cold start.

05Remote Config values

You normally change these through the admin pages. The table helps when you look at the admin_config parameter in Remote Config (Firebase: Remote Config parameters).

Editing the JSON by hand works, but the next publish from the admin overwrites it, and the admin checks addresses and ranges for you.

06Where data is stored

Who can read and write each collection is decided by crypto_wallet/firestore.rules.