Production Setup

This document outlines all manual configuration steps required to set up Girard AI integrations in production.

---

Table of Contents

1. Social Media OAuth Apps
   • LinkedIn
   • Twitter/X
   • Facebook & Instagram
   • YouTube
   • TikTok
   • Pinterest
   • Threads
2. Calendar Integrations
   • Google Calendar
   • Microsoft Outlook
   • Apple Calendar (iCloud)
3. Email Integrations
4. Payment Processing
5. Status Page
6. API Rate Limiter V2
7. Webhook Management
8. Workflow Versioning
9. Drift Detection
10. Access Control V2
11. Token Rotation
12. Key Vault
13. Secret Vault
14. Policy Engine V2
15. Communication Services
16. AI Services
17. Monitoring & Error Tracking
18. Environment Variables Checklist

---

Social Media OAuth Apps

LinkedIn

Developer Portal: https://www.linkedin.com/developers/apps

Setup Steps:

1. Go to LinkedIn Developer Portal and click "Create App"
2. Fill in app details:
   • App name: "Girard AI"
   • LinkedIn Page: Select your company page
   • App logo: Upload logo
3. Under "Auth" tab, add OAuth 2.0 settings:
   • Authorized redirect URLs: https://your-domain.com/api/oauth/linkedin/callback
4. Request the following products:
   • "Sign In with LinkedIn using OpenID Connect"
   • "Share on LinkedIn" (for posting)
5. Copy credentials to environment variables

Required Scopes:

• openid - For authentication
• profile - Read user profile
• w_member_social - Post content

Environment Variables:

LINKEDIN_CLIENT_ID=your_client_id
LINKEDIN_CLIENT_SECRET=your_client_secret

---

Twitter/X

Developer Portal: https://developer.twitter.com/en/portal/dashboard

Setup Steps:

1. Create a Twitter Developer account (requires phone verification)
2. Create a new Project and App
3. Set up User authentication settings:
   • Type: Web App
   • Callback URL: https://your-domain.com/api/oauth/twitter/callback
   • Website URL: https://your-domain.com
4. Enable OAuth 2.0 with PKCE
5. Copy Client ID and Client Secret

Required Scopes:

• tweet.read - Read tweets
• tweet.write - Post tweets
• users.read - Read user profile
• offline.access - Refresh tokens

Environment Variables:

TWITTER_CLIENT_ID=your_client_id
TWITTER_CLIENT_SECRET=your_client_secret

Notes:

• Twitter API access requires approval which may take 24-48 hours
• Free tier has limited API access (1,500 tweets/month)
• Consider Pro or Business tier for production use

---

Facebook & Instagram

Developer Portal: https://developers.facebook.com/

Setup Steps:

1. Create a Meta Developer account
2. Create a new App (Type: Business)
3. Add Facebook Login product:
   • Valid OAuth Redirect URIs:
     • https://your-domain.com/api/oauth/facebook/callback
     • https://your-domain.com/api/oauth/instagram/callback
4. Add Instagram Basic Display API (for Instagram)
5. Add the following permissions:
   • pages_show_list
   • pages_read_engagement
   • pages_manage_posts
   • instagram_basic
   • instagram_content_publish
6. Submit for App Review (required for production)

Environment Variables:

FACEBOOK_APP_ID=your_app_id
FACEBOOK_APP_SECRET=your_app_secret

Notes:

• Instagram requires a Facebook Page connected to an Instagram Business Account
• App must be reviewed by Facebook before going live
• Review process can take 2-4 weeks

---

YouTube

Developer Console: https://console.cloud.google.com/

Setup Steps:

1. Create a Google Cloud project (or use existing)
2. Enable YouTube Data API v3
3. Create OAuth 2.0 credentials:
   • Application type: Web application
   • Authorized redirect URIs: https://your-domain.com/api/oauth/youtube/callback
4. Configure OAuth consent screen:
   • Add scopes for YouTube API
   • Add test users (for development)
   • Submit for verification (for production)

Required Scopes:

• https://www.googleapis.com/auth/youtube.readonly - Read channel info
• https://www.googleapis.com/auth/youtube.upload - Upload videos
• https://www.googleapis.com/auth/youtube.force-ssl - Manage videos
• https://www.googleapis.com/auth/userinfo.profile - User profile

Environment Variables:

GOOGLE_CLIENT_ID=your_client_id
GOOGLE_CLIENT_SECRET=your_client_secret

Notes:

• Same credentials can be used for Google Sheets, Google Calendar, and YouTube
• Verification required for sensitive scopes (can take weeks)

---

TikTok

Developer Portal: https://developers.tiktok.com/

Setup Steps:

1. Create a TikTok Developer account
2. Create a new app in TikTok Developer Portal
3. Configure Login Kit:
   • Redirect URI: https://your-domain.com/api/oauth/tiktok/callback
4. Request the following scopes:
   • user.info.basic
   • video.publish
   • video.list
5. Submit for review

Environment Variables:

TIKTOK_CLIENT_KEY=your_client_key
TIKTOK_CLIENT_SECRET=your_client_secret

Notes:

• TikTok uses client_key instead of client_id
• App review required for video publishing permissions
• Only business accounts can publish via API

---

Pinterest

Developer Portal: https://developers.pinterest.com/

Setup Steps:

1. Create a Pinterest Developer account
2. Create a new app
3. Configure OAuth settings:
   • Redirect URI: https://your-domain.com/api/oauth/pinterest/callback
4. Request the following scopes:
   • boards:read
   • boards:write
   • pins:read
   • pins:write
   • user_accounts:read

Environment Variables:

PINTEREST_APP_ID=your_app_id
PINTEREST_APP_SECRET=your_app_secret

Notes:

• Pinterest API access requires approval
• Rate limits apply based on app tier

---

Threads

Developer Portal: https://developers.facebook.com/ (Threads API)

Setup Steps:

1. Use existing Meta Developer account
2. Create a new App or add Threads API to existing app
3. Configure OAuth:
   • Redirect URI: https://your-domain.com/api/oauth/threads/callback
4. Request Threads permissions:
   • threads_basic
   • threads_content_publish
   • threads_manage_insights

Environment Variables:

THREADS_APP_ID=your_threads_app_id
THREADS_APP_SECRET=your_threads_app_secret

Notes:

• Threads API is relatively new (launched 2024)
• Requires Meta app review
• Only available for business/creator accounts

---

Calendar Integrations

Google Calendar

Uses same Google Cloud credentials as YouTube.

Additional Steps:

1. Enable Google Calendar API in Cloud Console
2. Add calendar scopes to OAuth consent screen

Required Scopes:

• https://www.googleapis.com/auth/calendar
• https://www.googleapis.com/auth/calendar.events

---

Microsoft Outlook

Azure Portal: https://portal.azure.com/

Setup Steps:

1. Register an app in Azure AD
2. Configure authentication:
   • Redirect URI: https://your-domain.com/api/oauth/outlook-calendar/callback
   • Supported account types: Personal + Work accounts
3. Add API permissions:
   • Microsoft Graph: Calendars.ReadWrite
   • Microsoft Graph: User.Read

Environment Variables:

MICROSOFT_CLIENT_ID=your_client_id
MICROSOFT_CLIENT_SECRET=your_client_secret

---

Apple Calendar (iCloud)

Apple Calendar uses CalDAV protocol with app-specific passwords.

Setup Steps:

1. Users generate an app-specific password at https://appleid.apple.com/
2. Store credentials securely in database per user
3. CalDAV endpoint: https://caldav.icloud.com/

Notes:

• No OAuth - uses username/app-specific password
• Each user needs their own credentials
• Two-factor authentication required on Apple ID

---

Email Integrations

Resend (Transactional Email)

Dashboard: https://resend.com/

Setup Steps:

1. Create Resend account
2. Verify sending domain (add DNS records)
3. Create API key

Environment Variables:

RESEND_API_KEY=re_xxxxx

IMAP Integration

For generic email servers, users provide their own IMAP credentials.

Supported Presets:

• Gmail: imap.gmail.com:993
• Outlook: outlook.office365.com:993
• Yahoo: imap.mail.yahoo.com:993

---

Payment Processing

Stripe

Dashboard: https://dashboard.stripe.com/

Setup Steps:

1. Create Stripe account
2. Get API keys from Developers section
3. Set up webhook endpoint:
   • URL: https://your-domain.com/api/webhooks/stripe
   • Events: checkout.session.completed, invoice.paid, etc.
4. Copy webhook signing secret

Environment Variables:

STRIPE_SECRET_KEY=sk_live_xxxxx
STRIPE_WEBHOOK_SECRET=whsec_xxxxx
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxxxx

Durable State:

• Apply prisma/migrations/20260514_payment_processing_durable_storage before exposing payment-processing routes.
• Production defaults to Prisma-backed payment methods, transactions, refunds, and disputes; PAYMENT_PROCESSING_STORAGE=memory is for tests or local demos only.
• Reconcile provider webhook events against stored transaction/refund/dispute records before promoting the payment surface beyond beta.

---

Status Page

Durable State:

• Apply prisma/migrations/20260514_status_page_durable_storage before exposing status-page incident or subscriber workflows.
• Production defaults to Prisma-backed components, groups, incidents, incident updates, maintenance windows, subscribers, and uptime entries; STATUS_PAGE_STORAGE=memory is for tests or local demos only.
• Wire real check workers and SLO dashboards before promoting status-page workflows beyond beta.

---

API Rate Limiter V2

Durable State:

• Apply prisma/migrations/20260514_api_rate_limiter_v2_durable_storage before exposing rate-limiter control-plane routes or analytics/violation reporting.
• Production defaults to Prisma-backed limits, rules, overrides, limiters, analytics, and violations; API_RATE_LIMITER_V2_STORAGE=memory is for tests or local demos only.
• Wire the persisted control plane into runtime enforcement and rate-limit/SLO dashboards before promoting this surface beyond beta.

---

Webhook Management

Durable State:

• Apply prisma/migrations/20260514_webhook_management_durable_storage before exposing webhook-management endpoint or delivery workflows.
• Production defaults to Prisma-backed endpoints and deliveries; WEBHOOK_MANAGEMENT_STORAGE=memory is for tests or local demos only.
• Wire replay semantics, delivery workers, signature verification telemetry, and delivery SLO dashboards before promoting webhook-management beyond beta.

---

Workflow Versioning

Durable State:

• Apply prisma/migrations/20260514_workflow_versioning_durable_storage before exposing workflow-versioning workflows, branches, versions, merges, or diffs.
• Production defaults to Prisma-backed workflow-versioning tables; WORKFLOW_VERSIONING_STORAGE=memory is for tests or local demos only.
• Align workflow run/retry/access flows and OpenAPI docs with the persisted versioning control plane before promoting the broader workflow surface beyond beta.

---

Drift Detection

Durable State:

• Apply prisma/migrations/20260514_drift_detection_durable_storage before exposing drift-detection baselines, scans, drifts, policies, or exclusions.
• Production defaults to Prisma-backed drift-detection tables; DRIFT_DETECTION_STORAGE=memory is for tests or local demos only.
• Feed scans from trusted observed resource snapshots, wire scan scheduling/retry telemetry, and document provider collection requirements before promoting drift detection beyond beta.

---

Access Control V2

Durable State:

• Apply prisma/migrations/20260514_access_control_v2_durable_storage before exposing access-control-v2 policies, roles, grants, assignments, evaluations, audits, or stats.
• Production defaults to Prisma-backed access-control-v2 tables; ACCESS_CONTROL_V2_STORAGE=memory is for tests or local demos only.
• Align policy semantics, admin UX, OpenAPI docs, mutation audit events, and access-control observability before promoting this surface beyond beta.

---

Token Rotation

Durable State:

• Apply prisma/migrations/20260514_token_rotation_durable_storage before exposing token-rotation tokens, policies, schedules, audits, audit logs, or stats.
• Production defaults to Prisma-backed token-rotation tables; TOKEN_ROTATION_STORAGE=memory is for tests or local demos only.
• Wire actual secret-provider rotation workers, mutation audit events, OpenAPI docs, and rotation SLO dashboards before promoting this surface beyond beta.

---

Key Vault

Durable State:

• Apply prisma/migrations/20260514_key_vault_durable_storage before exposing key-vault vaults, secrets, keys, access policies, or stats.
• Production defaults to Prisma-backed key-vault tables; KEY_VAULT_STORAGE=memory is for tests or local demos only.
• Wire external KMS/HSM/provider integration, encrypted secret material handling, mutation audit events, OpenAPI docs, and vault/key SLO dashboards before promoting this surface beyond beta.

---

Secret Vault

Durable State:

• Apply prisma/migrations/20260514_secret_vault_durable_storage before exposing secret-vault vaults, secrets, access policies, audit entries, or stats.
• Production defaults to Prisma-backed secret-vault tables; SECRET_VAULT_STORAGE=memory is for tests or local demos only.
• Wire external vault/provider integration, encrypted secret material handling, immutable audit retention, OpenAPI docs, and secret-access SLO dashboards before promoting this surface beyond beta.

---

Policy Engine V2

Durable State:

• Apply prisma/migrations/20260514_policy_engine_v2_durable_storage before exposing policy-engine-v2 policies, rules, evaluations, bindings, exemptions, or stats.
• Production defaults to Prisma-backed policy-engine-v2 tables; POLICY_ENGINE_V2_STORAGE=memory is for tests or local demos only.
• Align policy semantics, admin UX, mutation audit events, OpenAPI docs, and policy-decision SLO dashboards before promoting this surface beyond beta.

---

Communication Services

Twilio (SMS/Voice)

Console: https://console.twilio.com/

Setup Steps:

1. Create Twilio account
2. Get Account SID and Auth Token
3. Purchase phone number(s)
4. Configure webhook URLs for incoming messages

Environment Variables:

TWILIO_ACCOUNT_SID=ACxxxxx
TWILIO_AUTH_TOKEN=your_auth_token
TWILIO_PHONE_NUMBER=+1234567890

---

AI Services

Anthropic (Claude)

Console: https://console.anthropic.com/

ANTHROPIC_API_KEY=sk-ant-xxxxx

OpenAI

Platform: https://platform.openai.com/

OPENAI_API_KEY=sk-xxxxx

Google AI (Gemini)

AI Studio: https://aistudio.google.com/

GOOGLE_AI_API_KEY=AIzaSy_xxxxx

---

Monitoring & Error Tracking

Sentry

Dashboard: https://sentry.io/

Setup Steps:

1. Create Sentry project (Next.js)
2. Get DSN from project settings
3. Configure source maps upload for production

Environment Variables:

SENTRY_DSN=https://xxxxx@sentry.io/xxxxx
SENTRY_AUTH_TOKEN=sntrys_xxxxx

---

Environment Variables Checklist

Required for Production

# Database
DATABASE_URL=postgresql://...

# Authentication (Clerk)
CLERK_SECRET_KEY=sk_live_xxxxx
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_live_xxxxx

# Payments (Stripe)
STRIPE_SECRET_KEY=sk_live_xxxxx
STRIPE_WEBHOOK_SECRET=whsec_xxxxx
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_xxxxx

# AI Providers
ANTHROPIC_API_KEY=sk-ant-xxxxx
OPENAI_API_KEY=sk-xxxxx

# Email
RESEND_API_KEY=re_xxxxx

# Error Tracking
SENTRY_DSN=https://xxxxx@sentry.io/xxxxx

Social Media OAuth (All Required for Full Functionality)

# LinkedIn
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=

# Twitter/X
TWITTER_CLIENT_ID=
TWITTER_CLIENT_SECRET=

# Facebook & Instagram
FACEBOOK_APP_ID=
FACEBOOK_APP_SECRET=

# YouTube (uses Google credentials)
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# TikTok
TIKTOK_CLIENT_KEY=
TIKTOK_CLIENT_SECRET=

# Pinterest
PINTEREST_APP_ID=
PINTEREST_APP_SECRET=

# Threads
THREADS_APP_ID=
THREADS_APP_SECRET=

Calendar Integrations

# Google (same as YouTube)
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Microsoft
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

Communication

# Twilio
TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=
TWILIO_PHONE_NUMBER=

---

Deployment Checklist

Before going to production:

• All OAuth apps approved and in production mode
• Webhook endpoints configured and verified
• DNS records set up for email sending domain
• SSL certificate valid
• Environment variables set in Vercel/hosting platform
• Database migrations applied
• Sentry error tracking configured
• Rate limits configured appropriately
• Backup strategy in place

---

Last Updated: February 9, 2026