Production integrations
Activate the included provider-ready path without rewriting the app.
Production setup is mostly account provisioning, secrets, migrations, dashboard configuration, and verification. The adapter code and Supabase backend resources are already in the repository.
Start after rebranding
Replace Vela, example identifiers, domains, support emails, icons, legal copy, and product IDs before configuring provider dashboards.
The one prompt
Read PRODUCTION-SETUP.md and agent-skills/setup-production-integrations.md.
Inventory the current adapters and lead me through production setup one provider
at a time. Start with Supabase. Never put a server secret in EXPO_PUBLIC_*.
Keep mock mode available. Stop before account creation, paid plans, deployment,
or submission unless I explicitly approve that action.What is already prepared
| Area | Included path |
|---|---|
| Auth and data | Supabase email OTP, Google/Apple, persisted session, Postgres, RLS |
| Uploads | Private normalized meal images and bounded voice audio with cleanup |
| Payments | RevenueCat offerings, purchase, restore, entitlement listener, webhook mirror |
| AI | Authenticated server-key chat, image analysis, transcription, quota checks |
| Analytics | Typed PostHog adapter without autocapture, replay, or GeoIP |
| Errors | Lazy Sentry adapter with payload scrubbing and source maps |
| Push | Expo token lifecycle, inbox, ticket storage, receipt checks, dead-token cleanup |
| Deletion | In-app and public bilingual flow with resumable provider cleanup receipts |
How each provider is activated
.env.local or EAS.Public versus server-only values
EXPO_PUBLIC_* values are compiled into the app and can be extracted. Public
Supabase publishable keys, RevenueCat platform SDK keys, PostHog project keys,
and Sentry DSNs may belong there when the provider intends them to be public.
Service-role keys, AI keys, webhook secrets, Apple private credentials, deletion secrets, Expo access tokens, and Sentry auth tokens stay in Supabase or EAS secrets—not in the app, source control, screenshots, or chat.
Production is an evidence claim
The release gate expects dated evidence from real devices, provider dashboards, store sandboxes, webhooks, push receipts, deletion receipts, legal review, and the exact builds you intend to ship. Automated checks validate structure; they cannot approve your store forms or prove a real provider worked.