DEPLOYMENT.md

# Deployment Configuration Guide

## Environment Variables

For a secure production deployment, you must set the following environment variables.

### 1. Frontend (Next.js)
These variables should be set in your Vercel project settings or `.env.production`.

| Variable | Description | Example Value |
|----------|-------------|---------------|
| `NEXTAUTH_URL` | The canonical URL of your site | `https://your-app.com` |
| `NEXTAUTH_SECRET` | A random string used to hash tokens | `openssl rand -base64 32` |
| `GOOGLE_CLIENT_ID` | OAuth Client ID from Google Cloud | `123...apps.googleusercontent.com` |
| `GOOGLE_CLIENT_SECRET` | OAuth Client Secret from Google Cloud | `GOCSPX-...` |
| `INTERNAL_API_KEY` | **CRITICAL**: Shared secret to talk to Python backend | `long-random-string-shared-with-backend` |
| `PYTHON_API_URL` | URL of your deployed Python backend | `https://api.your-app.com` |
| `DATABASE_URL` | Connection string for your production DB (e.g., Postgres) | `postgresql://user:pass@host:5432/db` |

> **Note on Database**: Currently, the app uses SQLite (`file:./dev.db`). For production, you should switch the `provider` in `prisma/schema.prisma` to `postgresql` or `mysql` and use a real database URL.

### 2. Backend (Python / FastAPI)
These variables should be set in your backend hosting service (e.g., Railway, Render, AWS).

| Variable | Description | Example Value |
|----------|-------------|---------------|
| `INTERNAL_API_KEY` | **CRITICAL**: Must match the Frontend key exactly | `long-random-string-shared-with-backend` |
| `OPENAI_API_KEY` | For generating animation code | `sk-...` |
| `ELEVENLABS_API_KEY` | For generating voiceovers | `...` |
| `ANTHROPIC_API_KEY` | (Optional) If using Claude models | `sk-ant-...` |
| `CODE_GEN_MODEL` | Model to use for code generation | `gpt-4o` or `claude-3-5-sonnet-20240620` |

## Security Checklist

1.  [ ] **Generate a Strong `INTERNAL_API_KEY`**: Use `openssl rand -hex 32` to generate a secure key. Set this on BOTH frontend and backend.
2.  [ ] **HTTPS Everywhere**: Ensure both your frontend and backend are served over HTTPS.
3.  [ ] **Database**: Do not use SQLite in production if you have multiple server instances (serverless). Use a managed Postgres database (e.g., Supabase, Neon, Railway).
4.  [ ] **CORS**: In `api_server.py`, update `allow_origins` to only allow your production frontend domain, not `*` or `localhost`.