Deployment-Anleitung

Secrets & API Keys

Quick reference for Google OAuth, Stripe, R2, PostHog, and other third-party credentials.

Store sensitive values in .dev.vars (local) or wrangler secret put (production). For integrations that need DNS verification and step-by-step setup, see Integrations in the sidebar.

Integration Guides (Recommended)

IntegrationDoc
Resend emailFull guide — API key, DNS, DMARC, verification

BETTER_AUTH_SECRET

bash
openssl rand -base64 32
pnpm wrangler secret put BETTER_AUTH_SECRET

Signs JWT session cookies. If leaked, rotate immediately and force users to sign in again.

Google OAuth

  1. Google Cloud Console → Credentials
  2. Create OAuth client ID → Web application
  3. Add authorized redirect URIs (local + production)
  4. Copy Client ID / Secret → env vars

Stripe

  1. Stripe Dashboard → Developers → API keys
  2. Copy Secret key → STRIPE_SECRET_KEY
  3. Webhooks → add endpoint → copy whsec_...

Forward webhooks locally:

bash
stripe listen --forward-to localhost:3000/api/stripe/webhook

Cloudflare R2

  1. Create bucket + API token (Object Read & Write)
  2. Configure wrangler.jsonc binding
  3. Set R2_* env vars

See Cloudflare Resources.

PostHog

VariableWhere to find
VITE_POSTHOG_TOKENProject settings → Project API Key
POSTHOG_PERSONAL_API_KEYPersonal API Keys → phx_...
POSTHOG_PROJECT_IDNumeric project ID

Google Analytics 4

  • Client: VITE_GA_MEASUREMENT_ID (stream measurement ID)
  • Admin: GCP service account + pnpm ga4:grant <PROPERTY_ID>, see docs/ga4-admin-spec.md

Good to know

Use Stripe live keys in production; test keys are for development only. GOOGLE_REDIRECT_URI must match Google Console character-for-character.