Operate · Markdown

Security

The pay page asks for one exact USDC transfer. It does not ask for a seed phrase, a private key, or an unlimited token approval.

RESEND_API_KEY and SALES_INGEST_TOKEN are Wrangler secrets. They do not belong in wrangler.jsonc, .dev.vars committed to git, logs, or chat.

ALLOW_FIXTURE_PAYMENTS stays false on every public hostname. The fixture route also stays closed when ENVIRONMENT is production.

The USDC contract is the token mint. It is not a receiving wallet.