Before you start
You need:- A Vercel account and a GitHub account.
-
Two independent random secrets,
AUTH_SECRETandENCRYPTION_SECRET. Generate each one separately:Save both values in a password manager. You must keep the same values for the life of the installation. LosingENCRYPTION_SECRETmakes saved AI-provider API keys unreadable.
Quotas and permitted use depend on your Vercel, Neon, and Upstash plans. Review Vercel limits, Neon, and Upstash before you choose a plan. Turn off automatic paid upgrades if you want to stay inside a free allowance.
Each AI agent run stops active work after four minutes. This keeps the run, plus saving and cleanup, inside Vercel Hobby’s five-minute Function limit. The limit applies to each question, not to the whole conversation. Docker uses the same limit.
Deploy
2
Choose the Git scope
On Hobby, select your personal GitHub account. Private repositories owned by a GitHub organization require Vercel Pro.
3
Connect the services
Approve Neon, Upstash, and Blob. Set Blob access to private. Pick nearby regions for all three, ideally close to the Function region (
iad1 by default).4
Enter the secrets
Paste
AUTH_SECRET and ENCRYPTION_SECRET.5
Deploy
Keep the project root at the repository root and keep the committed
vercel.json. Do not select the apps/web subdirectory and do not add an SPA fallback rewrite.The build compiles both apps and applies database migrations before the deployment goes live. You do not run migrations yourself.Check the deployment
- Open
https://<your-project>.vercel.app/api/health.database,storage, andredisshould all reporthealthy. A sleeping Neon database can fail the first check; retry once. - Open the production domain and create an account.
- Optional: add an AI provider under Settings to enable AI features.
- Optional: configure SMTP for verification and password-reset emails. Without SMTP, emails are written to the Function logs.
- Optional: add social or custom OAuth sign-in with the callback URLs in the SSO guide.
Use a custom domain
- Add the domain to the Vercel project.
- Set
APP_URLto the full origin, for examplehttps://resume.example.com. - Update the callback URLs of every OAuth provider you configured.
- Redeploy.
DEPLOYMENT_NAMESPACE.
Update the deployment
Redeploy the same project. Keep its connected services and secrets unchanged.- Migrations run in the build step, never in runtime Functions. A database advisory lock serializes concurrent deployments.
- Rolling back to an older deployment does not roll back the database schema. Keep migrations backward-compatible, or restore a database backup.
Preview deployments
Preview builds refuse to run migrations by default, so untrusted preview code cannot change your production database. To enable previews:- Connect separate Neon, Upstash, and Blob resources to the Preview environment.
- Set
ALLOW_PREVIEW_MIGRATIONS=truefor Preview only.
Back up your data
Back up the Neon database and the Blob store. StoreAUTH_SECRET and ENCRYPTION_SECRET separately from those backups.
Moving between Docker and Vercel does not copy the database or files. Migrate them yourself.
Build locally
A local Vercel build applies migrations, so run it only against an isolated database.APP_URL is required here. Cloud builds set it automatically.
Environment variables
Explicit variables take precedence over the Marketplace aliases listed here.
For SMTP, OAuth providers, and feature flags, use the same variables as Docker. See Self-hosting with Docker.
Upload limits
Vercel limits Function request bodies to 4.5 MB. The web app sends larger requests through private Blob staging, so these application limits still apply:- General uploads: 10 MB per file.
- Agent attachments: 25 MiB per file and 100 MiB per thread.
/api/openapi) and MCP request bodies stay subject to the 4.5 MB limit.