Security

Public marketing. Protected operations.

Streammerce separates acquisition pages from warehouse workflows so client data stays behind authentication in production.

Authenticated app access

Warehouse routes under /app stay behind Supabase auth when NEXT_PUBLIC_AUTH_REQUIRED is enabled in production.

Gate new accounts with NEXT_PUBLIC_ALLOW_SIGNUP and NEXT_PUBLIC_ALLOWED_EMAIL_DOMAINS for client-only rollouts.

Marketing pages remain public while logistics, labels, and scanning workflows stay inside the protected app shell.

Set `NEXT_PUBLIC_AUTH_REQUIRED=true` in production to protect `/app/*` routes.
Configure Supabase URL and anon key for session handling.
Gate signup with `NEXT_PUBLIC_ALLOW_SIGNUP` and optional email-domain allowlists.