Shipflash logoDocs

Go Live

Use a private repository, a production Supabase project, a deployment host, provider dashboards, and scheduled jobs.

On this page
  1. 1

    Create a private repository

    Keep the product source private unless your license or agreement allows public release.

  2. 2

    Create production Supabase

    Save the project URL, publishable key, secret key, database password, and project ref.

  3. 3

    Apply the database baseline

    Link the project and push migrations from a trusted machine or CI job. Do not reset production.

    text
    pnpm dlx supabase link --project-ref "$SUPABASE_PROJECT_REF"
pnpm dlx supabase db push --linked
pnpm run supabase:types:generate:linked
pnpm run supabase:types
  4. 4

    Deploy the app

    Set production environment values before the first deploy. Vercel is the default documented path.

  5. 5

    Deploy the selected billing webhook path

    Register only the webhook endpoint that matches the provider edition. If using the Supabase Edge ingress, deploy it after the database baseline and keep the application worker active for projection.

    • Stripe: /api/webhooks/stripe/billing
    • Lemon Squeezy: /api/webhooks/lemonsqueezy
    • Dodo: /api/webhooks/dodo
    • Polar: /api/webhooks/polar
    • Creem: /api/webhooks/creem
    • Worker: GET /api/cron/billing-webhooks
  6. 6

    Configure auth redirects

    Add the production site URL and callback URLs in Supabase Auth settings.

  7. 7

    Create the first admin

    Confirm the first super admin can reach admin pages, billing operations, analytics, and settings.

Launch smoke test

  • Sign up, sign in, sign out, and return to the protected dashboard.
  • Open billing setup and confirm the selected provider is ready.
  • Run a test checkout and confirm the customer history updates after webhook processing.
  • Run the billing webhook worker and confirm duplicate events do not create duplicate access or credit grants.
  • Send a test email from the configured sender.
  • Call each scheduled endpoint with the cron secret.
  • Confirm logs do not include raw tokens, secrets, or full provider payloads.