Setup checklist (operator)

What Kordox needs configured to be fully live. Most features are built; they just need credentials/secrets. Set API secrets with wrangler secret put NAME from apps/api (append --env production for prod; run once per environment). Never commit secrets.

✅ Already configured (prod)

CREDENTIALS_KEY, DATABASE_URL, JWT_SECRET, ORIGIN_SECRET, RESEND_API_KEY (email send), GOOGLE_CLIENT_ID/SECRET (Google login), GMAIL_CLIENT_ID/SECRET. Bindings (KV, R2, Hyperdrive, Workers AI) and CLOUDVERA_URL are set. FX rates need no key.

---

Priority 1 — turn the money half + AI live

A. Connect revenue — no secret, do it in-app ⭐ fastest value

Per venture: Connectors → Connect → Stripe → paste a restricted API key. Create the key in Stripe → Developers → API keys → Create restricted key with Read on Balance, Charges, Refunds, Subscriptions, Payouts. → real P&L, MRR, churn, LTV, ROAS, runway, anomalies. (Shopify/Square/PayPal/Plaid/AWS/GCP/ Cloudflare also connect with their own keys in the same modal.)

B. AI layer (briefing narrative, Kordox Ask, AI digests) — CV_KEY

Without it, the AI briefing uses a data-only fallback and Ask is unavailable.

npx wrangler secret put CV_KEY            # CloudVera API key (CLOUDVERA_URL is already set)

---

Priority 2 — billing + abuse protection

C. Platform subscription billing (charge for Kordox plans)

Test price IDs are wired; set live keys to go live:

npx wrangler secret put STRIPE_SECRET_KEY        # platform Stripe (sk_live_…)
npx wrangler secret put STRIPE_WEBHOOK_SECRET     # from the Stripe webhook endpoint
npx wrangler secret put STRIPE_PRICE_PRO_MONTHLY
npx wrangler secret put STRIPE_PRICE_PRO_ANNUAL
npx wrangler secret put STRIPE_PRICE_BUSINESS_MONTHLY
npx wrangler secret put STRIPE_PRICE_BUSINESS_ANNUAL

Webhook endpoint: https://api.kordox.com/api/billing/webhook (confirm path).

D. Bot protection on forms + login — Turnstile (optional)

npx wrangler secret put TURNSTILE_SECRET_KEY      # Cloudflare Turnstile

Web: set VITE_TURNSTILE_SITE_KEY in apps/web/.env (gates submit buttons when present).

E. Malware scanning for uploads (defense-in-depth without it; full scan with)

Public form + email attachments block dangerous types regardless; setting a scanner adds true malware detection (verdict "malicious" → rejected).

npx wrangler secret put MALWARE_SCAN_URL          # scanner endpoint (e.g. ClamAV on Cloud Run)
npx wrangler secret put MALWARE_SCAN_TOKEN        # optional bearer

---

Priority 3 — let END CUSTOMERS self-connect (multi-tenant OAuth)

Only needed when your users connect their own Stripe/Shopify/ad accounts without sharing keys. For your own ventures, Priority 1A (API keys) is enough. Full per-provider steps (redirect URIs, scopes, verification): see Ad & billing OAuth setup, Connector OAuth (incl. GCP one-click) and Email OAuth.

Unlocks	Secrets
Stripe Connect (customers' Stripe)	STRIPE_CLIENT_ID (+ STRIPE_SECRET_KEY)
Shopify app	SHOPIFY_CLIENT_ID/SECRET
Meta Ads (per-campaign spend → ROAS)	FACEBOOK_APP_ID/SECRET
Google Ads (per-campaign spend → ROAS)	GOOGLE_ADS_CLIENT_ID/SECRET + GOOGLE_ADS_DEVELOPER_TOKEN
HubSpot / Salesforce lead sync	HUBSPOT_CLIENT_ID/SECRET, SALESFORCE_CLIENT_ID/SECRET
Outlook mailbox (dormant — email model is forward/BCC now)	OUTLOOK_CLIENT_ID/SECRET

---

Verify after setting

• Secrets: npx wrangler secret list --env production.
• AI: open the dashboard — the Morning Briefing should show an AI narrative (not just the data snapshot).
• Money: connect a Stripe key, Sync now on the connector, check Finance + the dashboard venture grid.
• Connectors readiness: GET /api/financial/accounts returns oauthConfigured booleans the connect modal reads.