Operator Deployment

Use this when you are self-hosting Breakdown, operating a deployment, or contributing to the app. These secrets are not required to connect an external agent to hosted Breakdown.

Who Needs This

Hosted service users and off-repo coding agents should use https://www.breakdown.sh/api/mcp, setup sessions, and scoped bearer tokens. This page is for operators who manage the Breakdown app infrastructure.

Secrets Source Of Truth

Keep .env.local.example as the variable inventory. Real values should live in Doppler or an equivalent secrets manager, then sync into the hosting environment.

Recommended Configs

A straightforward setup is one project with separate dev, stg, and prd configs for local development, preview deployments, and production.

GroupVariables
ClerkNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, sign-in and sign-up URLs
SupabaseNEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY
Stored integration credentialsINTEGRATION_TOKEN_ENCRYPTION_KEY
Google DriveGOOGLE_DRIVE_CLIENT_ID, GOOGLE_DRIVE_CLIENT_SECRET, NEXT_PUBLIC_GOOGLE_DRIVE_API_KEY, NEXT_PUBLIC_GOOGLE_DRIVE_APP_ID

Integration Token Encryption

INTEGRATION_TOKEN_ENCRYPTION_KEY must decode to 32 bytes. Generate a value for each environment and store it only in the secrets manager.

openssl rand -base64 32

Local Development

doppler setup
doppler run -- pnpm secrets:check
pnpm dev:secrets

Hosted Deployment

  1. Sync preview deployments from the staging secrets config.
  2. Sync production deployments from the production secrets config.
  3. Redeploy after changing any build-time NEXT_PUBLIC_* value.
  4. Run a smoke test for the affected integration after each rotation.

Credential Rules

  • Do not commit real secrets.
  • Do not maintain duplicate manual values in the hosting dashboard.
  • User-managed AI provider API keys belong in app settings, not shared env vars.
  • Rotate upstream credentials after replacing them in the secrets manager.