diff --git a/.env.example b/.env.example
index 95c00d0..5b65a70 100644
--- a/.env.example
+++ b/.env.example
@@ -1,31 +1,35 @@
-NODE_ENV=development
+NODE_ENV=production
 
-# Shared infrastructure
-POSTGRES_DB=discord_saas
-POSTGRES_USER=discord_saas
-POSTGRES_PASSWORD=CHANGE_ME_STRONG_POSTGRES_PASSWORD
-POSTGRES_PORT=5432
-REDIS_PASSWORD=CHANGE_ME_STRONG_REDIS_PASSWORD
-DATABASE_URL=postgresql://discord_saas:CHANGE_ME_STRONG_POSTGRES_PASSWORD@localhost:5432/discord_saas
-DATABASE_SSL=false
+# PORT PUBLIC
+WEB_PORT=3000
 
-# OAuth2 + auth API
+# DB
+POSTGRES_DB=
+POSTGRES_USER=
+POSTGRES_PASSWORD=
+
+# REDIS
+REDIS_PASSWORD=
+
+# URLS PROD
+WEB_URL=https://yourdomain.com
+API_BASE_URL=http://api:4000
+NEXT_PUBLIC_API_BASE_URL=https://api.yourdomain.com
+
+# DISCORD
 DISCORD_CLIENT_ID=
 DISCORD_CLIENT_SECRET=
-DISCORD_REDIRECT_URI=http://localhost:4000/auth/discord/callback
-JWT_SECRET=CHANGE_ME_LONG_RANDOM_SECRET
+DISCORD_REDIRECT_URI=https://api.yourdomain.com/auth/discord/callback
+
+# Session/auth
+JWT_SECRET=
 JWT_EXPIRES_IN=7d
-SESSION_COOKIE_NAME=saas_session
-COOKIE_SECURE=false
-WEB_URL=http://localhost:3000
-API_BASE_URL=http://localhost:4000
+SESSION_COOKIE_NAME=__Host-saas_session
+COOKIE_SECURE=true
 
 # Encryption key for bot tokens (32 bytes base64)
-TOKEN_ENCRYPTION_KEY=REPLACE_WITH_32_BYTE_BASE64_KEY
+TOKEN_ENCRYPTION_KEY=
 
 # Multi-tenant API limits
 TENANT_RATE_LIMIT_MAX=120
 TENANT_RATE_LIMIT_WINDOW_SECONDS=60
-
-# Web
-NEXT_PUBLIC_API_BASE_URL=http://localhost:4000
diff --git a/apps/web/i18n/routing.ts b/apps/web/i18n/routing.ts
index cec2dce..dbc26a3 100644
--- a/apps/web/i18n/routing.ts
+++ b/apps/web/i18n/routing.ts
@@ -24,7 +24,7 @@ export const RTL_LOCALES = ["ar"] as const;
 export const routing = defineRouting({
   locales: [...APP_LOCALES],
   defaultLocale: "en",
-  localePrefix: "always",
+  localePrefix: "as-needed",
   localeDetection: true,
 });
 
diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index 090305d..f50d147 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -1,9 +1,10 @@
 import createMiddleware from "next-intl/middleware";
-
 import { routing } from "./i18n/routing";
 
 export default createMiddleware(routing);
 
 export const config = {
-  matcher: ["/((?!api|_next|_vercel|.*\\..*).*)"],
+  matcher: [
+    "/((?!api|auth|_next|_vercel|.*\\..*).*)"
+  ],
 };
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 7418102..ff94ad8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -82,8 +82,8 @@ services:
       DATABASE_URL: postgresql://${POSTGRES_USER:-discord_saas}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-discord_saas}
       DATABASE_SSL: "false"
       REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
-      WEB_URL: ${WEB_URL:-http://localhost:3000}
-      API_BASE_URL: ${API_BASE_URL:-http://localhost:4000}
+      WEB_URL: ${WEB_URL}
+      API_BASE_URL: ${API_BASE_URL}
     depends_on:
       postgres:
         condition: service_healthy
@@ -115,8 +115,6 @@ services:
         condition: service_healthy
       api:
         condition: service_started
-    ports:
-      - "4100:4100"
     networks:
       - edge_net
       - backend_net
@@ -127,19 +125,19 @@ services:
       context: .
       dockerfile: apps/web/Dockerfile
       args:
-        NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:4000}
+        NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL}
     env_file:
       - .env
     environment:
       NODE_ENV: production
       PORT: 3000
-      NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:4000}
-      API_BASE_URL: ${API_BASE_URL:-http://api:4000}
+      NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL}
+      API_BASE_URL: http://api:4000
     depends_on:
       api:
         condition: service_started
     ports:
-      - "3000:3000"
+      - "${WEB_PORT}:3000"
     networks:
       - edge_net
       - backend_net