Deployment setup

Connected. Data mode is supabase.

Supabase provides Postgres with row level security, authentication (email, OAuth providers) and private storage for locked media. Without it the app runs on the development store, which is fine locally and must not be used in production.

Not configured. Purchases and membership checkout show a setup required state.

Stripe Checkout and saved cards handle purchases (post unlocks, tips, paid messages, live tickets, custom requests) and Checkout handles memberships (subscriptions), Stripe Connect Express pays creators and the Billing Portal lets fans manage invoices. A purchase is granted and a membership activated only from a confirmed Stripe result (the PaymentIntent status or the webhook), so the webhook secret is mandatory.

Set.

Signs the development session cookie and other short lived tokens. Generate at least 32 random bytes and keep it out of version control.

Supabase Storage, private bucket "media". ffmpeg 8.0.1-3ubuntu2 found, videos are processed.

Uploads are stored privately and only served after an access check on every request. Images are processed by the bundled sharp library (orientation, metadata removal, sizes, blurred previews). Videos need the ffmpeg and ffprobe programs on the server: apt install ffmpeg on Debian or Ubuntu, apk add ffmpeg on Alpine, brew install ffmpeg on macOS. Restart is not needed after installing; retry failed videos from the vault.

Configured. Email goes out through your SMTP server.

Any SMTP provider works: Namecheap Private Email, Gmail with an app password, Amazon SES or Resend. Every attempt is logged in Admin, Email, where you can also send a test email. Configure the same server in Supabase Auth so sign up and password emails use it too.

Configured. People can turn on push in their notification settings.

Push uses VAPID keys and the browsers' push services (Chrome, Edge, Firefox, Safari). Generate the keys once with npm run vapid:generate and keep them: new keys invalidate every existing subscription. The webPush feature flag in admin settings must be on. On iPhone and iPad push works after the app is added to the home screen.

In process delivery. Correct for a single server process; set REALTIME_DATABASE_URL when you run several instances.

Badges, toasts, message threads and admin progress update live over server sent events on /api/realtime. Behind nginx, turn off buffering for that path (the deploy kit does).

Not configured. The live studio shows a setup required state and viewers see that live streaming is not available.

Live video runs on LiveKit: LiveKit Cloud (create a project and copy its URL, API key and secret) or your own LiveKit server with TLS on its domain and TURN enabled. The app signs short lived tokens on the server: viewers receive a subscribe only token after the entitlement check, the creator a publisher token, and rooms are created and closed through the LiveKit server API. Stories need no extra service.

Set. Call /api/cron/all every few minutes from a crontab or Vercel Cron.

The scheduler calls /api/cron/all with the secret as a bearer token; it runs every job whose interval has elapsed (publishing scheduled posts, resuming announcements, log cleanup). Runs are logged with their duration and outcome in Admin, Email.