Production Deployment

A practical checklist for shipping Data Explorer to production, including Render/Vercel, required envs, migrations, OAuth callbacks, and the most common deployment pitfalls.

Frontend: Vercel

Great for shipping the client quickly, with strong CDN behavior and only one required API URL to point to the backend.

Backend: Render

A solid fit for the NestJS backend and Prisma, as long as your build command syncs the schema before boot.

1. Recommended build commands

Backend service (Render)

Build command

npm run build

Start command

npm run start:prod

Run `npx prisma migrate deploy` before starting the app. The repository's Render Blueprint performs this step and only serves a release after its readiness check passes.

Frontend service (Vercel)

Frontend env

VITE_API_URL=https://your-backend-domain.com/api

2. Required environment variables

DATABASE_URL

The central database for the application.

JWT_SECRET

A strong secret used to sign access tokens. Placeholder values will be rejected by the backend.

REFRESH_TOKEN_SECRET

Recommended separate secret for the refresh-token cookie. If omitted, the app falls back to JWT_SECRET.

ENCRYPTION_KEY

Must be exactly 32 characters to encrypt saved connection passwords.

FRONTEND_URL

The real frontend origin used for CORS and OAuth redirects.

API_PUBLIC_URL

Public API base URL; required for billing return and webhook flows.

REDIS_URL

Redis connection URL for caching, queues, notifications, presence, search indexing, and rate-limiting.

ADMIN_EMAIL

Initial admin email (Seeding).

ADMIN_PASSWORD

Initial admin password. Strong password recommended.

3. OAuth checklist

GOOGLE_CALLBACK_URL and GITHUB_CALLBACK_URL must point to the real backend, for example https://your-backend.onrender.com/api/auth/google/callback.
FRONTEND_URL must match the real client origin, otherwise the exchange flow after /login#code=... will fail.
When the frontend and backend live on different production domains, use HTTPS so the refresh-token cookie can work with the correct secure + sameSite policy.
After changing any OAuth env, redeploy the backend so the callback/controller loads the new configuration.

4. AI provider envs

Optional AI lanes

# Premium lane

GEMINI_API_KEY=...

AI_PROVIDER_TIMEOUT_MS=90000

AI_STREAM_IDLE_TIMEOUT_MS=90000

# Lower-cost lane

CEREBRAS_API_KEY=...

CEREBRAS_BASE_URL=https://api.cerebras.ai/v1

CEREBRAS_CHAT_MODEL=llama3.1-8b

# Flexible / fallback lane

OPENROUTER_API_KEY=...

OPENROUTER_BASE_URL=https://openrouter.ai/api/v1

OPENROUTER_CHAT_MODEL=

# Low-latency lane

GROQ_API_KEY=...

GROQ_BASE_URL=https://api.groq.com/openai/v1

GROQ_CHAT_MODEL=openai/gpt-oss-120b

# Explicit Beeknoee lane

BEEKNOEE_API_KEY=...

BEEKNOEE_BASE_URL=https://platform.beeknoee.com/api/v1

BEEKNOEE_CHAT_MODEL=glm-4.7-flash

If you want image attachments to work in production AI chat, configure at least one true vision lane such as Gemini or an image-capable OpenRouter model.

5. Common deployment failures

Schema drift

The backend ships new code before its migration is applied, causing 500 errors in login or dashboard APIs.

Weak secret

A placeholder JWT_SECRET will prevent the backend from booting.

Wrong callback domain

Google/GitHub login will fail if callback URLs or FRONTEND_URL do not match the real deployment.

For a safe release: use Vercel for the client, the Render Blueprint for the backend, set envs correctly, migrate before startup, then test login, readiness, and one real query before going public.

PreviousSecurity & Privacy Next Testing & Contribution

Ready to explore data?

Join the community on GitHub to contribute to the smartest local database IDE.

Launch App