# Deploying Anytime AI to a real domain

This app was originally deployed with Vercel's direct file-upload flow, which
has no build-time environment variable injection — so API keys were hardcoded
in the route files. That's now fixed: all secrets are read from environment
variables (see `.env.example`), and the project is a real git repo so it can
be deployed the standard way, which is what you need for a custom domain,
redeploys, and safe key rotation.

## 1. Push this repo to GitHub

```bash
git remote add origin https://github.com/<your-username>/anytime-ai.git
git branch -M main
git commit -m "Move secrets to env vars, prep for git-based deploy"
git push -u origin main
```

(The initial commit is already made locally — just add your remote and push.)

## 2. Import the project into Vercel

1. https://vercel.com/new → Import the GitHub repo.
2. Framework preset: Next.js (auto-detected).
3. Before the first deploy, add Environment Variables (Project → Settings →
   Environment Variables), for **Production**, **Preview**, and
   **Development**:

   | Key | Value |
   |---|---|
   | `NEXT_PUBLIC_SUPABASE_URL` | `https://eyvcurjtbifrjkzlqoiu.supabase.co` |
   | `NEXT_PUBLIC_SUPABASE_ANON_KEY` | (Supabase → Project Settings → API → anon public key) |
   | `GROQ_API_KEY` | (from console.groq.com/keys) |
   | `RESEND_API_KEY` | (from resend.com/api-keys) |
   | `RESEND_FROM_ADDRESS` | e.g. `noreply@yourdomain.com`, once verified in step 4 |

   Your current local values for these are in `.env.local` (not committed).

4. Deploy. You'll get a `*.vercel.app` URL — confirm the app works there
   first.

## 3. Attach your custom domain

1. Vercel → Project → Settings → Domains → add `yourdomain.com` (and
   `www.yourdomain.com` if you want both).
2. Vercel shows the DNS records to add at your domain registrar:
   - Apex domain (`yourdomain.com`): an `A` record to Vercel's IP, or an
     `ALIAS`/`ANAME` if your registrar supports it.
   - `www` subdomain: a `CNAME` to `cname.vercel-dns.com`.
3. Add those records at your registrar's DNS panel. Propagation can take a
   few minutes to a few hours. Vercel auto-issues an SSL certificate once
   DNS resolves.

## 4. Verify the domain on Resend (for real outgoing email)

Right now transactional email goes out via Resend's shared test address
(`onboarding@resend.dev`), which only delivers to your own Resend account
email. To send from your own domain:

1. Resend dashboard → Domains → Add Domain → enter `yourdomain.com`.
2. Add the TXT (SPF/DKIM) records Resend gives you at your DNS provider.
3. Once verified, set `RESEND_FROM_ADDRESS=noreply@yourdomain.com` in
   Vercel's env vars and redeploy.

## 5. Point Supabase Auth at the new domain

Supabase → Authentication → URL Configuration:

- **Site URL**: `https://yourdomain.com`
- **Redirect URLs**: add `https://yourdomain.com/auth/confirm`

Supabase → Project Settings → Auth → SMTP Settings (so confirmation emails
don't get silently rate-limited by Supabase's shared sender):

- Host: `smtp.resend.com`
- Port: `465`
- Username: `resend`
- Password: your Resend API key
- Sender email: your verified `noreply@yourdomain.com`
- Sender name: `Anytime AI`

## 6. Rotate the exposed keys (recommended)

The Groq and Resend keys were previously committed in plain text in this
project's history/config. Since they've been visible outside a proper
secret store, rotate them once you're set up:

- Groq: console.groq.com/keys → revoke old key, create a new one, update
  `GROQ_API_KEY` in Vercel.
- Resend: resend.com/api-keys → revoke old key, create a new one, update
  `RESEND_API_KEY` in Vercel.

## Notes

- The Supabase anon key is safe to keep public (it's enforced by Postgres
  Row Level Security) — it stays in `public/widget.js` as a plain string by
  design, since that file is a static asset embedded on third-party sites.
- The dashboard's embed snippet (`app/dashboard/page.js`) already builds
  the `<script>` tag from `window.location.origin`, so it automatically
  uses your custom domain once DNS is live — no code change needed there.