Environment Setup

PreviousNext

Vercel variables and the Dev, Stage, and Production analytics model

Rules

  1. Dev and Production use the same PostHog project token.
  2. Every deployment sends an explicit normalized environment property.
  3. The App and Auth must use the same token and ingestion host for cross-origin replay.
  4. Secrets and real token values are configured in Vercel and never committed.
  5. Any change to a NEXT_PUBLIC_* variable requires a new deployment because Next.js embeds it at build time.

zooly-app projects

Configure both the Dev App and Production App with the following variables. Values differ only where shown.

VariableDevProductionPurpose
NEXT_PUBLIC_POSTHOG_PROJECT_KEYsame project tokensame project tokenBrowser replay SDK
POSTHOG_PROJECT_KEYsame project tokensame project tokenServer event delivery
NEXT_PUBLIC_POSTHOG_HOSThttps://us.i.posthog.comsameBrowser ingestion
POSTHOG_HOSThttps://us.i.posthog.comsameServer ingestion
NEXT_PUBLIC_JOURNEY_ENVIRONMENTdevelopmentproductionBrowser event/replay property
JOURNEY_ENVIRONMENTdevelopmentproductionServer and persisted event property
JOURNEY_EVENT_INGEST_SECRETunique shared Dev secretunique shared Prod secretAuth-to-App endpoint
CRON_SECRETsecretsecretPending-delivery retry endpoint

POSTHOG_PROJECT_URL=https://us.posthog.com/project/<project-id> is required only where a PostHog UI deep link is built; it is not the ingestion host.

Shared zooly-auth

Auth routes events back to the App environment that initiated the flow.

VariableValue
NEXT_PUBLIC_POSTHOG_PROJECT_KEYsame token used by App
NEXT_PUBLIC_POSTHOG_HOSThttps://us.i.posthog.com
NEXT_PUBLIC_JOURNEY_ENVIRONMENTstatic environment label for Auth's browser replay anchor
JOURNEY_EVENT_INGEST_DEV_URLhttps://dev.zooly.ai
JOURNEY_EVENT_INGEST_DEV_SECRETexactly the Dev App ingest secret
JOURNEY_EVENT_INGEST_PROD_URLhttps://app.zooly.ai
JOURNEY_EVENT_INGEST_PROD_SECRETexactly the Production App ingest secret

The allowed origins are intentionally restricted to dev.zooly.ai, app.zooly.ai, and the supported local Dev origin. The URL and secret for each target must be configured as a matching pair.

Auth's server journey events are classified dynamically from the validated App origin. The Auth browser replay anchor still uses the static NEXT_PUBLIC_JOURNEY_ENVIRONMENT value of the shared Auth deployment; use the parent App's environment as the authoritative session filter until that label is derived dynamically.

Public site (zooly.ai)

The marketing site records browser sessions with the same project token and ingestion host as the app. Set these on the website project. With no environment label, a visit to zooly.ai or www.zooly.ai is recorded as production.

VariableValue
NEXT_PUBLIC_POSTHOG_PROJECT_KEYsame token used by App
NEXT_PUBLIC_POSTHOG_HOSThttps://us.i.posthog.com
NEXT_PUBLIC_JOURNEY_ENVIRONMENTproduction on the public site

The home page, conference page, PhotoBomb page, and merch page load the recorder when someone opens the page, so the token is not copied into those files. The website deployment that serves the recorder has to be live. After that, setting the token takes effect on the next visit.

zooly-stats

VariablePurpose
READ_ONLY_PROD_DBProduction database used by the executive journey dashboard
POSTHOG_PROJECT_URLBase UI URL for direct Replay links
NEXT_PUBLIC_AUTH_URLCentral Auth origin
NEXT_PUBLIC_STATS_URLDeployed Stats origin used for return URLs

Stats does not need a PostHog ingestion token. It reads aggregate data from Production and only constructs a PostHog UI URL when a replay is available.

Stage behavior

Stage carries the same code toward Production, but it has no independent analytics dataset in this design. Do not expect Stage activity in the executive dashboard. Keep Stage credentials and domains aligned with the release strategy rather than inventing a third environment value.

Safe configuration procedure

  1. Open the intended PostHog project and copy its project token.
  2. Set server and public token/host variables on App.
  3. Set the same public token/host on Auth.
  4. Set explicit environment variables on App and Auth.
  5. Pair each Auth ingest URL with the matching App secret.
  6. Set Stats read-only Production DB and PostHog project UI URL.
  7. Redeploy every project whose NEXT_PUBLIC_* values changed.
  8. Start a completely new browser session and run the smoke test.

Never paste real tokens or secrets into source code, documentation, tickets, or screenshots.