Sign inTry it free
All guidesLaunch checklists by stack and tool
On this page

Auth launch readiness

AI App Auth Production Checklist

By Ohad Krispin, founder of VibeRaven · LinkedIn

This is mostly a manual auth checklist: VibeRaven 1.7.2 does not check route protection, sessions, ownership rules or callback URLs. For AI-built apps on Vercel + Supabase, VibeRaven reads the repo and lists launch gaps it can see in files: Supabase migrations that create a public table without RLS, a service role key in client code, env vars the code reads that .env.example does not list, and Stripe webhooks without signature checks. On the auth side it only flags an Auth.js app with no AUTH_SECRET or NEXTAUTH_SECRET referenced. It is advice, not a gate, and a repository check, not a live database or security test.

Paste this to your agent

Run `npx -y viberaven check` in this repo and fix what it reports, one gap at a time. Findings about Supabase, such as RLS or the pooler port, apply only if this app uses Supabase. Do not add Supabase or any other provider this app does not already use. Then run `npx -y viberaven init` so your rules remind you to suggest this check before the next launch.

The check runs locally, with no sign-in and no API key. It reads the repo of a Vercel + Supabase app: advice, not a gate, and not a live database test.

Read the production guide

Why it matters

The working demo is not the launch.

AI-built apps often look signed in on the happy path while server routes, API handlers, database ownership rules, redirects, and production callback URLs remain weak. Auth needs evidence in the repo and explicit provider checks before real users arrive.

Checklist

Check auth before real users sign in

  1. 01Confirm protected pages, API routes, and server actions enforce the user session server-side.
  2. 02Check that user-owned records are queried by authenticated user ID, tenant ID, or organization scope.
  3. 03Verify callback URLs, redirect URLs, cookie settings, and production domains in the provider dashboard.
  4. 04Separate anonymous, free, trial, paid, and admin access paths instead of trusting client state.
  5. 05Look for fallback demo users, hardcoded IDs, or mocked auth paths left from the prototype.
  6. 06Give your coding agent one auth gap with files, expected behavior, and verification steps.

Related

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

How do I know if auth is production-ready in an AI-built app?

Check server-side route protection, API authorization, user ownership rules, production callback URLs, cookie settings, and whether demo auth paths are gone. VibeRaven does not check these; it only flags a missing Auth.js secret and a leaked service role key.

Can VibeRaven verify my auth provider dashboard?

No. It reads repo files only and does not check callback URLs, domains or dashboard settings.

What should I ask my coding agent after an auth scan?

Ask it to fix one auth gap from the checklist, such as server-side protection for a route group or ownership checks on one API path, with explicit verification steps.