From 1a4aa26b8b8ccfdc1c1572710d6576a639e0d4df Mon Sep 17 00:00:00 2001
From: vicrodh <103399283+vicrodh@users.noreply.github.com>
Date: Fri, 24 Apr 2026 10:23:57 -0600
Subject: [PATCH] docs(api-keys): reflect proxy-based architecture, remove .env
 instructions

.env.example is now a placeholder pointing to the hosted Cloudflare
Workers proxy. README updates the API Proxy section accordingly and
.gitignore adds CLAUDE.md and AGENTS.md.

cc
---
 .env.example | 33 ++++++++++-----------------------
 .gitignore   |  4 ++++
 README.md    | 26 +++-----------------------
 3 files changed, 17 insertions(+), 46 deletions(-)

diff --git a/.env.example b/.env.example
index 3ffdf11d4..01db3eafc 100644
--- a/.env.example
+++ b/.env.example
@@ -1,23 +1,10 @@
-# Last.fm API Configuration
-# Create your own Last.fm API application at: https://www.last.fm/api/account/create
-# These credentials are required for scrobbling functionality
-
-LAST_FM_API_KEY=your_api_key_here
-LAST_FM_API_SHARED_SECRET=your_shared_secret_here
-LAST_FM_APP_NAME=your_app_name
-LAST_FM_APP_REGISTER=your_lastfm_username
-
-# Discogs API Configuration
-# Create your own Discogs application at: https://www.discogs.com/settings/developers
-# These credentials are used for fetching album artwork
-
-DISCOGS_API_CLIENT_KEY=your_consumer_key_here
-DISCOGS_API_CLIENT_SECRET=your_consumer_secret_here
-
-
-# Tidal API Configuration (for playlist import)
-# Create your own Tidal application at: https://developer.tidal.com/
-# These credentials are used for importing playlists from Tidal
-
-TIDAL_API_CLIENT_ID=your_client_id_here
-TIDAL_API_CLIENT_SECRET=your_client_secret_here
+# This file is kept as a placeholder for legacy tooling. QBZ no longer reads
+# third-party API credentials from a .env file — Last.fm, Discogs, Tidal,
+# Spotify-import, and MusicBrainz all go through the Cloudflare Workers
+# proxy at qbz-api-proxy.blitzkriegfc.workers.dev, with the URL hardcoded as
+# a const in each service module (src-tauri/src/lastfm/mod.rs,
+# discogs/mod.rs, playlist_import/providers/tidal.rs, musicbrainz/client.rs).
+#
+# Source builds work out of the box without any keys. If you want to use
+# your own proxy, deploy https://github.com/vicrodh/qbz-api-proxy and edit
+# the *_PROXY_URL constants in the service modules above.
diff --git a/.gitignore b/.gitignore
index 60a3f1906..5f09df81a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -75,6 +75,10 @@ qbz-nix-docs/
 # AI agent instructions and planning docs (untracked)
 .github/copilot-instructions.md
 docs/superpowers/
+CLAUDE.md
+AGENTS.md
+
 /crates/target/
 # /crates/Cargo.lock  # tracked for reproducible qbzd CI builds
 test-results/
+
diff --git a/README.md b/README.md
index 56588b636..26b68209b 100644
--- a/README.md
+++ b/README.md
@@ -275,31 +275,11 @@ npm run tauri dev       # development
 npm run tauri build     # production (DEB, RPM, AppImage)
 ```
 
-### API Proxy (for self-hosted builds)
+### API Proxy
 
-Pre-built releases include a hosted API proxy for Last.fm, Discogs, Tidal, and Spotify integrations — no API keys needed.
+Last.fm, Discogs, Tidal, Spotify-import, and MusicBrainz traffic goes through a hosted Cloudflare Workers proxy (`qbz-api-proxy.blitzkriegfc.workers.dev`) that holds all credentials server-side. Both pre-built releases and source builds use it out of the box — **no API keys or `.env` file required**.
 
-If you build from source and want these integrations, you can either:
-
-1. **Deploy your own proxy** (recommended) — a Cloudflare Worker that securely holds API keys server-side:
-
-```bash
-git clone https://github.com/vicrodh/qbz-api-proxy.git
-cd qbz-api-proxy
-# Add your API keys to wrangler.toml or via `wrangler secret put`
-wrangler deploy
-```
-
-Then set the proxy URL before building QBZ:
-
-```bash
-export QBZ_API_PROXY_URL="https://your-worker.your-account.workers.dev"
-npm run tauri build
-```
-
-2. **Use direct API keys** — set them in `.env` (see `.env.example`). Keys are embedded at compile time.
-
-> MusicBrainz and Spotify playlist import work without any API keys or proxy.
+If you want to run against your own proxy (for development, or if you fork QBZ), the proxy source lives at [`vicrodh/qbz-api-proxy`](https://github.com/vicrodh/qbz-api-proxy). Deploy it with `wrangler deploy` and then edit the `*_PROXY_URL` constants in `src-tauri/src/lastfm/mod.rs`, `discogs/mod.rs`, `playlist_import/providers/tidal.rs`, and `musicbrainz/client.rs` to point at your worker before rebuilding.
 
 ### Environment Variables