| name | external-integration-launch-gate |
| description | Use when planning, building, auditing, debugging, testing, deploying, or declaring done for any feature where an outside system calls the app or the app depends on provider callbacks, including Stripe payments/webhooks, Resend webhooks, Supabase Auth callbacks, OAuth redirects, Vercel Cron, SMS gateways, provider webhooks, callback URLs, API keys, Preview/Production environment variables, deployment protection, and provider sandbox/live mode. |
| activation | Activate when the description trigger applies to the current task. |
| required_inputs | Task request, relevant repository context, constraints, and authority dependencies. |
| required_outputs | Skill-specific artifact, verification evidence, canonical verdict, and next action. |
| authority_dependencies | 00_start_here/SOURCE_OF_TRUTH.md; 10_governance/APIVR_EXECUTION_LIFECYCLE.md; 10_governance/source_of_truth/Elite_Build_Goals_v3.md. |
| evidence_requirements | Executed checks or an honest Unknown, Not Run, or Blocked state for every material claim. |
External Integration Launch Gate
Use this skill when the real outside world must reach the app. This is a hard gate for payments, auth callbacks, email webhooks, cron, SMS queues, provider callbacks, and any Preview/Production environment split.
Do not claim done, ready, PASS, fixed, or launch-safe until the provider-to-deployed-app round trip is verified through the real deployed URL, not only through unit tests or direct route-handler tests.
Required Inputs
- Provider, account/environment, and dashboard location.
- Exact deployed URL the provider calls.
- Route path and source file.
- Caller type: human, provider, scheduler, admin, or internal system.
- Required security: human login, provider signature, shared secret, admin role, or public-safe behavior.
- Environment values by tier: Production, Preview, Local.
- Expected provider events, callbacks, redirects, or scheduled calls.
- Expected database writes, user-visible result, logs, and retry behavior.
Activation Checklist
Trigger this gate when any task mentions or touches:
- Stripe, payments, subscriptions, checkout, customer portal, refunds, disputes, premium access.
- Resend, transactional email, delivery/open webhooks, OTP/email delivery.
- Supabase Auth, OAuth, Google/Facebook login, callback URLs, redirect URLs, session cookies.
- Vercel Cron, scheduled routes, queues, reminders, background jobs, monitors.
- Webhooks, callbacks, provider events, API keys, secrets, rate limits, sandbox/test mode.
- Vercel Preview, Production, deployment protection, custom domains,
NEXT_PUBLIC_APP_URL, provider dashboard URLs.
Route Classification
Classify every relevant route before planning or fixing.
| Route type | Human login? | Required protection | Never allowed |
|---|
| Human app page | As needed | session and role checks | provider-only secret as sole control |
| Admin page/API | Yes | session plus admin role | public access |
| Public page/API | No | safe public behavior and input limits | private data leakage |
| Stripe webhook | No | Stripe signature and idempotency | redirect to login, Vercel auth block |
