4. Configure your own services

Understand the three locations

app/core/product.ts: public product, enabled features and plans; app/core/payment-catalog.json supplies the provider price IDs.
wrangler.local.jsonc / wrangler.jsonc: local or remote resources and non-sensitive runtime vars.
.dev.vars / Cloudflare Worker Secrets: local or remote private credentials.

Local .dev.vars is not uploaded automatically. Preserve its generated authentication secret. Never put credentials in requirements, Markdown, Skill packages or Git. The repository README contains the complete parameter table and provider-specific setup instructions.

Prepare an isolated preview

Use a new Worker, D1 database, private R2 bucket and Workflow. Set remote APP_ENV=preview and APP_URL to the exact HTTPS address you will visit. The template does not define named Wrangler --env environments. Do not point test configuration at production data.

Connect accounts and email first

Generate an independent BETTER_AUTH_SECRET of at least 32 characters.
For Google, create a Web OAuth Client. Register the actual origin and APP_URL/api/auth/callback/google. Configure GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET; One Tap uses the same Client ID.
Enable Cloudflare Email Sending for your domain, retain the EMAIL binding and set a verified-domain EMAIL_FROM. The native binding does not need an SMTP or REST API key.
Create a Turnstile widget for the site hostname. Put its public key in TURNSTILE_SITE_KEY and its private key in TURNSTILE_SECRET_KEY.
Verify signup, actual received verification mail, password reset and both Google login flows.

Connect models and payments

For AI, choose an adapter per workflow with AI_PROVIDERS_JSON. OpenAI compatible workflows use OPENAI_API_KEY, an HTTPS OPENAI_BASE_URL and their model IDs. Workers AI uses an AI binding and WORKERS_*_MODEL; fal image generation/editing uses FAL_API_KEY and its model paths. Configure only the selected services. Web search also needs BRAVE_SEARCH_API_KEY, an answer model and a brave-web-search cost entry. Set actual USD rates, source URLs and checked dates in MODEL_COSTS_JSON, then use AI_MODE=live and inspect a real result. See AI workflow configuration for supported combinations and recovery.

For payment, use BILLING_MODE=test, choose BILLING_PROVIDER and supply only that platform's keys. Match test:<planId> mappings in app/core/payment-catalog.json with provider products and register /api/webhooks/waffo, /stripe or /creem under your own origin. The sandbox ioy payment command can populate the catalog; test checkout, recurring events and refunds separately. See the payment checklist.

Connect analytics and administration

GA4_ID is the browser Measurement ID. Backend reports also require the numeric GA4_PROPERTY_ID, service account email/private key and property read access. With a configured ID, analytics starts automatically without a consent prompt or saved consent choice. Browser DNT/GPC and sensitive-data filtering remain in place. Verify received events in GA4; a configured ID alone is not delivery evidence.

Add your official administrator email to ADMIN_EMAILS, enable TOTP in the reference account and verify ordinary users are rejected by the dashboard. Configure ALERT_EMAIL only when real sending works.

Which optional services should I enable?

Optional modules start disabled. Waitlist/newsletter require explicit subscription, confirmation and a verified Resend sender; Beehiiv can be the confirmed-contact destination while Resend still sends confirmation and product notices. Follow growth operations before enabling either flag or sending a reviewed message.

Umami, Plausible, Clarity and Crisp use their own public project identifiers. Follow optional integrations to verify loading and sensitive-path filtering. The generated project's README also explains operational Discord/Feishu notifications and the separately built browser extension; register the extension's exact stable Origin and approve its pairing from a verified account.

Write remote secrets carefully

After changing remote configuration, rebuild so Wrangler does not use an old generated deployment target:

npm run build
npx wrangler secret put GOOGLE_CLIENT_ID
npx wrangler secret put GOOGLE_CLIENT_SECRET
npx wrangler secret list

These commands write to the selected remote Worker; secret put updates a deployed version. Confirm account and Worker first, use interactive input, and configure test and production separately. Continue to step 5: deployment and acceptance.

How do I select email and control costs?

Template 1.3.0 supports Cloudflare and Resend through the same mail service. Choose emailProvider in requirements, set EMAIL_PROVIDER=resend with RESEND_API_KEY, and verify your sender domain. Register /api/webhooks/resend and set RESEND_WEBHOOK_SECRET separately. Provider acceptance and delivered events are different evidence. Resend explains idempotency.

Each model rate requires source and updatedAt as well as complete, finite nonnegative rates. All-zero rates require an explicitly free provider. Account file limits reserve capacity before upload; deletion also removes private receipts. Node 24 LTS is required. The generated project's launch-config.json records non-secret service choices; configurationReady does not imply provider acceptance.