What you do
Every step in the setup and deploy skills that needs a person, grouped by service, with where to click and what to give the agent.
Outcome: you know every step that is yours before you start, and you can prepare the accounts in advance. Everything not on this page is done by the agent.
The agent asks for each value only when the step that needs it is reached, one at a time, and prints the exact click path then. This page collects the same steps in one place. The click paths come from the skills, which date them to late 2026; dashboards change their menus, so treat each path as a guide (check the dashboard, menus move). If a label differs, the value is still there, usually under "API keys" or a Connect button.
Giving a value to the agent: paste it into the chat, or write it into .env.local yourself under the name the agent asked for and say "done". The agent never prints a key back and never commits one.
At a glance
| Service | Needed for | Your steps |
|---|---|---|
| Neon or Supabase | everything | create a database, paste the connection string, name the owner email |
| Google Cloud | sign-in | create the OAuth client, paste ID and secret, sign in once |
| GitHub, Cloudflare Turnstile | optional sign-in extras | create an OAuth app or a widget, paste two values |
| Stripe | payments | paste the secret key, confirm the CLI login, enable payment methods, one test payment |
| Resend | pick the sender address, paste the key, add DNS records, confirm the test mail | |
| Cloudflare R2 | uploads | create bucket and token, turn on public access, paste five values |
| AI provider | AI features | create an account, add billing, paste the key |
| Upstash and a tunnel | AI video only | create a Redis database, start a tunnel locally |
| Cloudflare Workers | deploy (option 1) | Workers Paid plan, API token, domain on Cloudflare, attach the domain |
| Vercel | deploy (option 2) | connect GitHub, log in the CLI, add the domain's DNS records |
Database: Neon or Supabase
Skill: setup-database, details in Database. Pick one provider.
| Step | Where to click | Give the agent |
|---|---|---|
| Create a Neon database (recommended) | console.neon.tech → New project (any name, the region closest to your users) → Create → on the project dashboard Connect → keep Connection pooling on → copy the connection string. Its host contains -pooler. (check the dashboard, menus move) |
DATABASE_URL |
| Or create a Supabase database | supabase.com/dashboard → New project (set a database password and keep it) → open the project → Connect (top bar) → Connection string → Transaction pooler (port 6543) → copy, then replace [YOUR-PASSWORD] with your password. (check the dashboard, menus move) |
DATABASE_URL |
| Or any other Postgres | your provider's connection string, postgres://user:password@host:port/database |
DATABASE_URL |
| Name the site owner | the email you will sign in with. There is no password: you sign in with Google or an email code using this address | the email |
| If the database already holds data | say yes or no when the agent asks before it migrates | an answer |
At launch: create a second, separate database for production and give the agent its connection string.
Sign-in: Google
Skill: setup-auth, details in Auth. The agent prints the exact redirect URI and origin before you start.
| Step | Where to click | Give the agent |
|---|---|---|
| Create the OAuth client | Google Cloud Console → pick or create a project → APIs & Services → OAuth consent screen (Google Auth Platform): app name, support email, audience External → Clients → Create client → type Web application → Authorized JavaScript origins: http://localhost:3000 → Authorized redirect URIs: http://localhost:3000/api/auth/callback/google → Create. (check the dashboard, menus move) |
Client ID, then Client secret |
| Sign in once for real | open the site, sign in with Google using the superadmin email; /dashboard must show the admin menu |
"done" |
| If Google says access blocked | while the consent screen is in Testing, only listed test users can sign in: add your account as a test user | nothing |
At launch:
- In the same client, add
https://<your-domain>to Authorized JavaScript origins andhttps://<your-domain>/api/auth/callback/googleto Authorized redirect URIs. - Publish the consent screen (out of Testing). No script can check this one.
- Sign in once with Google on the live domain.
Sign-in extras (optional)
| Step | Where to click | Give the agent |
|---|---|---|
| GitHub sign-in | github.com → Settings → Developer settings → OAuth Apps → New OAuth App → Homepage URL: the site; Authorization callback URL: http://localhost:3000/api/auth/callback/github → Register application → copy Client ID → Generate a new client secret. (check the dashboard, menus move) |
Client ID, Client secret |
| Cloudflare Turnstile (bot check on email sign-in) | Cloudflare dashboard → Turnstile → Add widget → add the site's hostnames and localhost → copy Site Key and Secret Key. (check the dashboard, menus move) |
Site Key, Secret Key |
At launch: a production callback URL for GitHub (https://<your-domain>/api/auth/callback/github), and your domain in the Turnstile widget's hostnames.
Payments: Stripe
Skill: setup-stripe, details in Stripe. Test mode first, live mode at launch.
| Step | Where to click | Give the agent |
|---|---|---|
| Paste the test secret key | Stripe Dashboard → Developers → API keys → Secret key, the sk_test_… one. (check the dashboard, menus move) |
STRIPE_SECRET_KEY |
| Say what you sell | one-time license, subscription or credit pack; price; currency; credits | your answer |
| Confirm the Stripe CLI login | stripe login opens a browser tab once; confirm the pairing code |
"done" |
| Enable payment methods | Stripe Dashboard → Settings → Payment methods. Cards are on by default; Alipay, WeChat Pay and others are a click each. The API cannot do this | "done" |
| One test payment | your site's pricing page, card 4242 4242 4242 4242, any future date, any CVC. The success page shows the plan, /dashboard/my-orders lists the order |
"done" |
At launch:
- Paste the live key (
sk_live_…). The agent creates the live prices and registers the production webhook. - Make one payment with a real card on the live site.
PayPal and Creem are supported by the code but have no setup skill yet.
Email: Resend
Skill: setup-email, details in Email.
| Step | Where to click | Give the agent |
|---|---|---|
| Pick the sender address | an address on your own domain, for example hello@yourdomain.com. All mail is sent from it and admin alerts are sent to it, so someone must read it. Gmail or Outlook addresses cannot be verified |
DEFAULT_ADMIN_EMAIL |
| Sender name (optional) | the name shown in inboxes; empty means your site name | DEFAULT_ADMIN_NAME |
| Create the API key | resend.com → API Keys → Create API Key → Permission Full access (the check reads your domain's status; a Sending access key cannot) → Add → copy the re_… key, it is shown once. (check the dashboard, menus move) |
RESEND_API_KEY |
| Add the DNS records | the agent prints 2 to 3 records (SPF as MX and TXT, DKIM as TXT or CNAME) with name, value and priority. Add them at your DNS provider exactly as printed. If your DNS panel shows the full name after saving, check the domain appears only once | "done" |
| Wait for verification | minutes, sometimes hours. The agent reruns the check; you do not need to look | nothing |
| Confirm the test mail | a mail [check-email] Sign in to … arrives in the inbox you named. Check spam |
"arrived" |
At launch: check your Resend plan's daily and monthly quotas. You may create a second key with Sending access only for production.
Alternative, Cloudflare Email Sending: a Cloudflare API token with the permission Account → Email Sending → Send, your Cloudflare account ID, and the sending domain set up for Email Sending in the Cloudflare dashboard. (check the dashboard, menus move)
Storage: Cloudflare R2
Skill: setup-storage, details in Storage.
| Step | Where to click | Give the agent |
|---|---|---|
| Create the bucket | Cloudflare dashboard → R2 Object Storage → Create bucket → a name (for example mysite-uploads), location Automatic, storage class Standard → Create bucket. The first time, Cloudflare may ask you to activate R2. (check the dashboard, menus move) |
R2_BUCKET_NAME |
| Copy the account ID | R2 Object Storage overview → Account ID | R2_ACCOUNT_ID |
| Create the R2 token | R2 Object Storage → Manage API tokens → Create API token → Permissions Object Read & Write → Specify bucket: this bucket only → Create. Copy Access Key ID and Secret Access Key; the secret is shown once. (check the dashboard, menus move) | R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY |
| Turn on public access | the bucket → Settings → Public access: R2.dev subdomain → Allow (for testing), or Custom Domains → Connect Domain (for production; the domain must be on Cloudflare) | R2_PUBLIC_URL, as https://host without a trailing slash |
| Paste the CORS rule, only if the agent asks | the bucket → Settings → CORS Policy → Add CORS policy → paste the JSON the agent prints → save | "done" |
Use a bucket of its own for uploads. The <site>-inc-cache bucket that the Cloudflare deploy creates holds the page cache, not user files.
At launch: switch R2_PUBLIC_URL to a custom domain before real users upload. Files already saved keep their old URLs.
AI provider
Skill: setup-ai, details in AI. Start with one provider: OpenRouter for text, fal or Replicate for images and video.
| Step | Where to click | Give the agent |
|---|---|---|
| Create the account and add billing | the provider's billing page. The API cannot add a card. (check the dashboard, menus move) | nothing |
| OpenRouter key | openrouter.ai → sign in → Keys → Create key. (check the dashboard, menus move) | OPENROUTER_API_KEY |
| Replicate token | https://replicate.com/account/api-tokens | REPLICATE_API_TOKEN |
| fal key | fal.ai → sign in → Dashboard → Keys → Add key. (check the dashboard, menus move) | FAL_KEY |
| DeepSeek key | https://platform.deepseek.com/api_keys | DEEPSEEK_API_KEY |
| OpenAI, Anthropic, Google, xAI or KIE key | the provider's console → API keys; links are in .env.example under # AI. (check the dashboard, menus move) |
the matching key |
| Pick the models | which models your product offers | your answer |
At launch: set a spending limit and billing alerts in each provider's dashboard. The API cannot set them.
Video only: Redis and a tunnel
| Step | Where to click | Give the agent |
|---|---|---|
| Create a Redis database | console.upstash.com → create a Redis database → copy the REST URL and REST token from its page. (check the dashboard, menus move) | UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN |
| Log in to a tunnel tool (local only) | the video provider must reach your machine; the agent starts a tunnel (for example ngrok or Cloudflare Tunnel). Log in if the tool asks | "done" |
Deploy: Cloudflare Workers
Skill: deploy-cloudflare, details in Cloudflare.
| Step | Where to click | Give the agent |
|---|---|---|
| Workers Paid plan | Cloudflare dashboard → Workers & Pages → Plans; check the current price there. The server Worker is too large for the free plan | "done" |
| Create the API token | My Profile → API Tokens → Create Token → Create Custom Token → add the permissions below → Account Resources: Include → your account → Continue → Create. Shown once. (check the dashboard, menus move) | the token, or save it in ~/.config/cloudflare/token yourself |
| Confirm the GitHub CLI scope | if gh lacks the workflow scope, the agent runs gh auth refresh -h github.com -s workflow; confirm the one-time code in the browser |
"done" |
| Add GitHub secrets by hand, only if the agent cannot | https://github.com/<owner>/<repo>/settings/secrets/actions/new, one secret per value the agent names |
"done" |
| Put your domain on Cloudflare | Cloudflare dashboard → Add a domain, then change the nameservers at your registrar | "done" |
| Attach the domain to the Worker | Workers & Pages → the front Worker (the one without -server) → Settings → Domains & Routes → Add → Custom domain → your hostname (and www. as a second entry if you want it). If Cloudflare refuses because a DNS record exists, delete that record under the domain's DNS → Records first. (check the dashboard, menus move) |
"done" |
| Budget alert (suggested) | the dashboard's billing settings. Cloudflare has no hard spending cap | nothing |
Token permissions:
| Scope | Permission | Access |
|---|---|---|
| Account | Workers Scripts | Edit |
| Account | Workers R2 Storage | Edit |
| Account | D1 | Edit |
| Account | Hyperdrive | Edit |
| Account | Account Settings | Read |
| User | Memberships | Read |
| User | User Details | Read |
A shorter way that also works: start from the Edit Cloudflare Workers template and add D1 Edit and Hyperdrive Edit.
Deploy: Vercel
Skill: deploy-vercel, details in Vercel.
| Step | Where to click | Give the agent |
|---|---|---|
| Connect GitHub to Vercel | vercel.com → Add New… → Project → Import Git Repository → install or adjust the GitHub app permissions → allow the repository. (check the dashboard, menus move) | "done" |
| Log in the CLI | vercel login, confirm once in the browser |
"done" |
| Node.js version | Project → Settings → Build and Deployment → Node.js Version: 22.x. (check the dashboard, menus move) |
"done" |
| Add the domain's DNS records | Project → Settings → Domains → Add shows the records (an A record for the apex, a CNAME for www). Add them at your DNS provider and wait until Vercel shows the domain as valid |
"done" |
| Deployment Protection, only if the live URL asks for a login | Project → Settings → Deployment Protection: production domains are normally public | "done" |
Your domain's DNS, in one place
Details for both platforms: Domain.
| Record | For | Who tells you the values |
|---|---|---|
| SPF (MX and TXT), DKIM (TXT or CNAME) | sending email from your domain | the agent, from check-email.ts --create-domain |
| Custom domain on the Worker | the site on Cloudflare | Cloudflare creates it when you attach the domain |
A (apex) and CNAME (www) |
the site on Vercel | Vercel's Domains page |
| Custom domain on the R2 bucket | public file URLs | Cloudflare creates it when you connect the domain to the bucket |
Before launch
- Live Stripe key, live prices, production webhook, one real card payment.
- Production values for every service, in the deployment's env: a separate database, a new
BETTER_AUTH_SECRET, your domain asNEXT_PUBLIC_SITE_URL. - Google: production URIs added and the consent screen published.
- R2: a custom domain as
R2_PUBLIC_URL. - AI: spending limits set at each provider.
/api/healthon your domain answers200with"status":"ok".