polymarket-analyst/PROVIDER_SETUP.md

Provider Setup

You signed up with emplusbodyworks@gmail.com for the selected launch stack:

• Clerk for authentication.
• Neon for Postgres storage.
• Veriff for KYC / KYB / AML workflow.
• Circle for USDC, wallets, deposits, withdrawals, and webhooks.
• Sentry for monitoring.

The app is wired for these providers, but private credentials must be copied from each provider dashboard into Vercel environment variables. Never commit real credentials to GitHub.

Vercel environment variables to add

Clerk

• AUTH_PROVIDER=Clerk
• CLERK_PUBLISHABLE_KEY
• CLERK_SECRET_KEY
• CLERK_WEBHOOK_SIGNING_SECRET

Clerk docs list CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, and CLERK_WEBHOOK_SIGNING_SECRET for app connection and webhook verification.

Neon

• DATABASE_URL
• NEON_DATABASE_URL optional alias; use the same value as DATABASE_URL

Use the pooled Neon connection string when possible. Neon connection strings look like postgresql://...neon.tech/dbname?sslmode=require....

Veriff

• KYC_PROVIDER=Veriff
• SANCTIONS_PROVIDER=Veriff
• GEOIP_PROVIDER=Veriff
• VERIFF_API_KEY
• VERIFF_SECRET_KEY
• VERIFF_WEBHOOK_SECRET

The app treats Veriff as the selected KYC provider. Actual verification-session creation is still locked until the final compliance flow is approved.

Circle

• PAYMENTS_PROVIDER=Circle
• WALLET_PROVIDER=Circle
• CIRCLE_API_KEY
• CIRCLE_WEBHOOK_SECRET
• CIRCLE_WALLET_SET_ID

Circle is wired as the selected payments/wallet provider. Live deposits, withdrawals, and wallet execution remain disabled until compliance, wallet signing, reconciliation, and testing are complete.

Sentry

• MONITORING_DSN
• SENTRY_DSN
• SENTRY_AUTH_TOKEN
• SENTRY_ORG
• SENTRY_PROJECT
• SENTRY_WEBHOOK_URL

SENTRY_DSN is exposed to the browser through /api/config so the frontend can initialize Sentry. Keep auth tokens server-side only.

Already safe to set

• ADMIN_ALERT_EMAIL=emplusbodyworks@gmail.com
• CUSTOMER_SUPPORT_EMAIL=emplusbodyworks@gmail.com
• PRODUCTION_APP_URL=https://polymarket-site-eta.vercel.app
• WEBHOOK_BASE_URL=https://polymarket-site-eta.vercel.app/api
• RESTRICTED_JURISDICTIONS=US,CA-NY,CA-ON
• LIVE_TRADING_ENABLED=false

Webhook URLs to paste into provider dashboards

These endpoints store provider events in Neon for audit/reconciliation prep. They do not move money or place orders.

• Clerk: https://polymarket-site-eta.vercel.app/api/webhooks/clerk
• Veriff: https://polymarket-site-eta.vercel.app/api/webhooks/veriff
• Circle: https://polymarket-site-eta.vercel.app/api/webhooks/circle

Provider event counts are visible at https://polymarket-site-eta.vercel.app/api/provider-events.

What is still intentionally locked

• Real deposits.
• Real withdrawals.
• Live Polymarket order placement.
• Automatic agent trading with real funds.

Newly wired backend endpoints

• Policies: https://polymarket-site-eta.vercel.app/api/policies
• Consent recording: https://polymarket-site-eta.vercel.app/api/consent
• Server risk profile: https://polymarket-site-eta.vercel.app/api/risk-profile
• Incident alerts: https://polymarket-site-eta.vercel.app/api/incident

The consent and incident endpoints are intentionally gated: consent needs real approved policy versions, and incident alerts need RISK_ADMIN_TOKEN.

Those should stay locked until legal review, eligibility checks, signed-order execution, reconciliation, audit logs, and incident response are complete.