Infrastructure: Configure All Third-Party API Credentials for Beta

[0xdevcollins]

Severity: HIGH — No External Services Work Without Real Keys

Problem

Every third-party service is using placeholder credentials. Nothing works end-to-end without real keys.

Services to Configure

1. Stripe (card payments)

• Create Stripe account → get STRIPE_SECRET_KEY (test mode)
• Set up webhook endpoint in Stripe Dashboard → get STRIPE_WEBHOOK_SECRET
• Add NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY for checkout frontend
• Test with Stripe test cards: 4242 4242 4242 4242

2. Resend (transactional email)

• Create Resend account → get RESEND_API_KEY (free tier: 3,000 emails/month)
• Verify sending domain (or use Resend's shared domain for beta)
• Test: trigger email verification flow

3. Cloudflare R2 (file storage)

• Create R2 bucket useroutr-assets
• Generate R2 API token → R2_ACCESS_KEY_ID + R2_SECRET_ACCESS_KEY
• Configure public access for logos, signed URLs for PDFs
• Set R2_ENDPOINT and R2_PUBLIC_URL

4. Circle CCTP (USDC bridge)

• Register at Circle Developer → get CIRCLE_API_KEY
• Configure for testnet initially
• Verify CCTP contracts are accessible on Base Sepolia

5. Layerswap (Starknet bridge)

• Register at Layerswap → get LAYERSWAP_API_KEY
• Test Starknet ↔ Stellar route availability

6. Stellar Relay Keypair

• Generate new Stellar keypair for relay: stellar keys generate relay --network testnet
• Fund with testnet XLM via friendbot
• Set STELLAR_RELAY_KEYPAIR_SECRET and STELLAR_RELAY_PUBLIC_KEY
• Ensure relay account has sufficient XLM for transaction fees

7. Wormhole

• Confirm WORMHOLE_ENV=Testnet is correct for beta
• No API key needed for Wormhole SDK (uses guardian network directly)

Deliverable

A completed, tested .env file (never committed) with all real credentials. Document in SETUP.md:

• Where to get each credential
• Which tier/plan to use for beta
• Estimated monthly cost at beta volume

Acceptance Criteria

• All 6 services have real credentials configured
• Full smoke test: send email, upload file, fetch Stripe balance
• SETUP.md documents credential acquisition for each service
• API boots without placeholder validation errors (from Environment: Harden Security — Secrets, JWT, and Pre-Beta Config Checklist #109)