{
  "_comment": "Runtime configuration for the InForm SPA, fetched at startup rather than baked in at build time, so ONE build artifact serves every environment: each environment ships its own copy of this file beside the bundle. Never commit real credentials here; this file is served publicly - a client id is public in the browser on every sign-in, which is why it can live here, and a client SECRET never can. The three auth* keys carry the dev-au tenant's values and mirror Auth:Authority and Auth:Audience in InForm.Spa.Api/appsettings.Development.json, which must agree with them; a deployed environment ships its own copy written by .octopus/inform.spa/deployment_process.ocl.",
  "apiUrl": "https://informapi-ng.au.quartex-dev.cloud",
  "onlineHelpUrl": "https://help.inxsoftware.com/inform",
  "orgOverride": "org_E426W0QVF9fzlYI3",
  "authAuthority": "https://login.au.quartex-dev.cloud/",
  "authClientId": "0WD337rDd9RvoTQLRFLmAJiPUCXx2AZa",
  "authAudience": "https://informapi-ng.au.quartex-dev.cloud/",
  "_informComment": "InForm-specific runtime settings, read by src/composables/useInFormSettings.ts rather than by useConfig.ts. useConfig.ts is byte-identical with frontend/management's copy by kit design (docs/decisions/frontend-shell-duplication.md), so an InForm-only key must not be added to it: management would then require a config value nothing there consumes. onlineHelpUrl is APP-027's external help site, opened in a new tab from the sidebar. orgOverride is the Auth0 Organization - name or id - used only when the host has no tenant subdomain to derive one from (localhost, bare IPs); src/auth/org.ts. A real subdomain always wins, so this value ships into every deployed package unread."
}