Deploy to Vercel

Run Webrizen SSO in production on Vercel's free plan with a free Neon PostgreSQL database. Plan for about 20 minutes.

Create the database

Create a project on Neon (open-source, serverless Postgres). From Connection details, copy the pooled connection string: the host contains -pooler and it ends with ?sslmode=require.

Create the tables

Run the migrations from your machine against Neon:

DATABASE_URL="postgres://user:pass@ep-…-pooler.neon.tech/neondb?sslmode=require" pnpm db:migrate

Import the project into Vercel

Push the repository to GitHub, then in Vercel choose Add New → Project and import it.

Root Directory: apps/accounts
Framework preset: Next.js (detected)

Vercel detects the pnpm workspace and installs from the repository root automatically.

Set environment variables

In Settings → Environment Variables:

Variable	Value
`BETTER_AUTH_URL`	`https://accounts.webrizen.com` (your final domain, no trailing slash)
`BETTER_AUTH_SECRET`	Output of `openssl rand -base64 32`. Never change it later
`DATABASE_URL`	The Neon pooled connection string
`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS`	See Email
`EMAIL_FROM`	`Webrizen <no-reply@webrizen.com>`
`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`	Optional, see Google
`PLATFORM_ADMIN_EMAILS`	Your email, so your first sign-up is a platform admin

Add your domain

In Settings → Domains, add accounts.webrizen.com and create the DNS record Vercel shows. HTTPS is provisioned automatically. Redeploy after changing environment variables.

Sign up and register your apps

Open your domain, create your account (you'll be a platform admin via PLATFORM_ADMIN_EMAILS), then register each product under Platform → Applications.

Email (SMTP)

Codes and invitations are sent with Nodemailer over SMTP. In production, sending fails loudly (and the request errors) if SMTP_HOST is missing, so codes are never silently lost.

Provider	`SMTP_HOST`	`SMTP_PORT`	Notes
Gmail / Google Workspace	`smtp.gmail.com`	`465`	Use an App Password
Zoho Mail (India)	`smtp.zoho.in`	`465`	Good fit for company domains
Brevo	`smtp-relay.brevo.com`	`587`	Generous free tier for transactional mail
Amazon SES	`email-smtp.<region>.amazonaws.com`	`587`	Cheapest at scale

Port 465 uses TLS from the start. Other ports upgrade with STARTTLS automatically.

Tip

Set up SPF and DKIM for your sending domain in your DNS. Without them, verification codes are likely to land in spam.

In Google Cloud Console → Credentials, create an OAuth client ID of type Web application.
Add the authorized redirect URI: https://accounts.webrizen.com/api/auth/callback/google.
Copy the client ID and secret into GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, then redeploy.

Deploying your SaaS apps

Each product is its own Vercel project with its own domain and @webrizen/sso variables (see Next.js SDK). Register each with its production redirect URI. Keep a separate registration for preview or staging URLs.

Database changes later

When you upgrade Better Auth or change the auth config:

pnpm --filter @webrizen/accounts auth:schema

pnpm db:generate

DATABASE_URL="…neon…" pnpm db:migrate

Commit the generated files in apps/accounts/drizzle/ so every environment runs the same migrations.