This guide is the canonical OSS setup and deployment reference for Opencom.
- Node.js 18+
- PNPM 9+
- Convex account
Use the repo bootstrap script:
./scripts/setup.shThe script performs dependency install, Convex initialization, basic auth env setup, local .env.local generation, and optional dev server start.
Update generated env files later with:
./scripts/update-env.sh --url https://<your-deployment>.convex.cloud --workspace <workspace-id>pnpm install
pnpm --filter @opencom/convex dev
pnpm dev:web
pnpm dev:widgetRecommended optional app entrypoints:
pnpm dev:landing
pnpm dev:mobile- Deploy Convex backend (
packages/convex) to your own project. - Configure web/mobile to connect via backend URL selection.
- Build web app:
pnpm build:web
pnpm --filter @opencom/web start- Set
NEXT_PUBLIC_OPENCOM_DEFAULT_BACKEND_URLin the deployment environment.
- Backend: deploy
packages/convex - Web/landing/widget/mobile: deploy each app according to your platform requirements
- For widget local distribution into web/landing public assets:
bash scripts/build-widget-for-tests.shFor a Cloudflare R2-backed widget distribution flow:
DRY_RUN=1 bash scripts/deploy-widget-cdn.sh
pnpm deploy:widget:cdnpnpm deploy:widget:cdn reads .env.local at repo root and runs scripts/deploy-widget-cdn.sh.
By default, each deploy publishes a unique immutable runtime key (v/<packageVersion>-<sha>[-<run_id>]/widget.js), and release tags widget-v* publish clean semver keys.
| Variable | Required | Purpose |
|---|---|---|
AUTH_SECRET |
Yes | Auth signing secret for Convex auth runtime |
SITE_URL |
Yes (dashboard env key) | Convex dashboard env key commonly set via convex env set SITE_URL ...; surfaced as CONVEX_SITE_URL in runtime |
CONVEX_SITE_URL |
Yes (runtime) | Auth provider domain used in convex/auth.config.ts |
AUTH_RESEND_KEY |
Optional | OTP provider API key override (falls back to RESEND_API_KEY) |
RESEND_API_KEY |
Optional (required for email features) | Transactional/campaign email sending |
EMAIL_FROM |
Optional | Sender identity for auth and email channel flows |
RESEND_WEBHOOK_SECRET |
Recommended | Verifies inbound Resend webhook signatures |
EMAIL_WEBHOOK_INTERNAL_SECRET |
Recommended | Internal webhook gateway secret for email handlers |
ENFORCE_WEBHOOK_SIGNATURES |
Optional (true default) |
Fail-closed webhook enforcement toggle |
WEBHOOK_MAX_AGE_SECONDS |
Optional | Replay-window bound for webhook signatures |
OPENCOM_PUBLIC_CORS_ORIGINS |
Required for production web origins | Allowlist for /.well-known/opencom.json CORS |
AI_GATEWAY_API_KEY |
Optional (required for AI agent generation) | AI provider credential |
AI_GATEWAY_BASE_URL |
Optional | AI provider base URL override |
OPENCOM_ENABLE_SERIES_ORCHESTRATION |
Optional (true default) |
Runtime guard for series orchestration |
OPENCOM_DEMO_BLOCKED_EMAIL_CAMPAIGN_WORKSPACE_IDS |
Optional | Comma-separated workspace IDs where outbound campaign sends are blocked |
ALLOW_TEST_DATA |
Test-only | Enables internal test-data mutations |
TEST_ADMIN_SECRET |
Test-only | Secret for testAdmin:runTestMutation gateway |
| Variable | Required | Purpose |
|---|---|---|
NEXT_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL |
Optional | Default backend shown/auto-selected for app users |
NEXT_PUBLIC_CONVEX_URL |
Optional | Used by widget-demo/e2e helper flows |
NEXT_PUBLIC_WIDGET_URL |
Optional | Widget bundle URL override for demo flows |
NEXT_PUBLIC_TEST_WORKSPACE_ID |
Optional (test/demo) | Widget demo workspace override |
| Variable | Required | Purpose |
|---|---|---|
EXPO_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL |
Optional | Default backend URL for mobile admin app |
| Variable | Required | Purpose |
|---|---|---|
NEXT_PUBLIC_WIDGET_URL |
Optional | Widget loader URL override (landing defaults: local dev /opencom-widget.iife.js, production https://cdn.opencom.dev/widget.js) |
NEXT_PUBLIC_OPENCOM_WEB_APP_URL |
Optional | Hosted app URL used in CTA links |
NEXT_PUBLIC_CONVEX_URL |
Optional | Convex URL for widget demo initialization |
NEXT_PUBLIC_WORKSPACE_ID |
Optional | Workspace for landing demo widget init |
| Variable | Required | Purpose |
|---|---|---|
VITE_CONVEX_URL |
Required for local widget dev mode | Convex URL used by dev bootstrap |
VITE_WORKSPACE_ID |
Required for local widget dev mode | Workspace for dev bootstrap |
| Variable | Required | Purpose |
|---|---|---|
EXPO_PUBLIC_CONVEX_URL |
Yes (for example app) | Convex backend URL |
EXPO_PUBLIC_WORKSPACE_ID |
Yes (for example app) | Workspace ID |
| Variable | Purpose |
|---|---|
E2E_BACKEND_URL |
Backend target for Playwright E2E helper layer |
E2E_TEST_PASSWORD |
Password used by E2E auth bootstrap |
TEST_ADMIN_SECRET |
Required for E2E test data seeding and cleanup helpers |
- CORS fails for
/.well-known/opencom.jsonin hosted environments- Set
OPENCOM_PUBLIC_CORS_ORIGINSon Convex to include production web origins.
- Set
- E2E seeding fails with unauthorized errors
- Ensure Convex deployment has matching
TEST_ADMIN_SECRETandALLOW_TEST_DATA=truein test environments.
- Ensure Convex deployment has matching
- OTP email flow unavailable
- Configure
AUTH_RESEND_KEYorRESEND_API_KEYplusEMAIL_FROM.
- Configure
- Testing + validation:
./testing-and-verification.md - Security + release gate operations:
./security-and-operations.md - Source-of-truth ownership:
./source-of-truth.md