Deployment & authentication guide

Set up the full Advertpreneur Connect stack.

This is the complete path from a fresh deployment to a connected WordPress site and an authenticated MCP or Action client: Vercel, Supabase storage, Supabase OAuth, WordPress Application Passwords and the Advertpreneur Connect endpoints.

Deploy the Next.js service to Vercel

Fork or clone the repository, import it into Vercel and deploy the main branch. Advertpreneur Connect automatically uses the Vercel production URL unless ADPC_BASE_URL is explicitly set.

git clone https://github.com/haseebgb92/advertpreneur-connect.git
cd advertpreneur-connect
npm install
npm run build

Your production service becomes the public bridge URL, for example https://advertpreneur-connect.vercel.app.

Create the private Supabase storage layer

Advertpreneur Connect does not store connected WordPress credentials directly in the Vercel filesystem. The service calls a private Supabase Edge Function using ADPC_STORE_URL and ADPC_STORE_TOKEN.

Storage contract

The Edge Function receives JSON actions such as upsert, list and get, protected by the x-adpc-token header. Stored WordPress application credentials are already encrypted by Advertpreneur Connect before being sent to storage.

Create a Supabase project, a private table for connected sites, and an Edge Function that implements this small storage contract. Keep the function token private and set its URL/token in Vercel.

Open the exact Supabase schema + Edge Function guide

Configure Supabase Auth for MCP OAuth

The MCP endpoint supports OAuth using Supabase Auth as its authorization server. Advertpreneur Connect publishes OAuth protected-resource metadata at /.well-known/oauth-protected-resource, pointing compatible MCP clients at the Supabase authorization server.

Current OAuth flow

/api/mcp challenges unauthenticated clients → client discovers the protected-resource metadata → OAuth is handled by Supabase Auth → Advertpreneur Connect validates the bearer token against Supabase /oauth/userinfo before granting MCP access.

The current OAuth flow uses a user-specific identity, which scopes site access. Configure the Supabase OAuth/authorization-server settings for the deployed project and make sure your allowed redirect/client configuration matches the MCP client you intend to use.

A separate static bearer remains supported through ADPC_MCP_BEARER_TOKEN for private non-OAuth MCP clients. If the variable is absent, static bearer access is not enabled.

Add the Vercel environment variables

ADPC_STORE_URLPrivate Supabase Edge Function URL used for connected-site storage.

ADPC_STORE_TOKENShared secret expected by the private storage Edge Function.

ADPC_ENCRYPTION_KEYLong random secret used to encrypt stored WordPress application credentials.

ADPC_STATE_SECRETLong random secret used to sign short-lived WordPress connection state.

ADPC_ACTION_TOKENBearer token used by the Action API / OpenAPI clients.

ADPC_MCP_BEARER_TOKENOptional static MCP bearer. Leave unset when using OAuth-only MCP access.

ADPC_APP_IDStable UUID presented to WordPress Application Password authorization.

Generate the encryption and state secrets as long random values. Never commit production values to GitHub.

Install the WordPress companion plugin

The Vercel service talks to the Advertpreneur Connect WordPress plugin through its REST namespace. The plugin provides the actual site-side capabilities for posts, pages, media, SEO, quality checks and WooCommerce.

Install and activate the companion plugin on every WordPress site you want the bridge to manage. Download the v0.7.1 WordPress plugin from GitHub.

Connect each WordPress site securely

Advertpreneur Connect uses WordPress's native Application Password authorization screen. It never asks for the site's normal WordPress password.

MCP: connect_site {"site_url":"https://example.com"}

Use the authenticated MCP connect_site tool to obtain the official WordPress approval URL; the anonymous legacy /connect URL is disabled by default. The user approves Advertpreneur Connect inside WordPress. WordPress then sends the application credential back to the bridge callback, where it is encrypted before being stored through the Supabase storage service.

Connect an Action/OpenAPI client

The Action API uses a privileged private integration token. Do not share ADPC_ACTION_TOKEN with Agensi buyers; customer agents must use the OAuth MCP endpoint.

Schema:
https://advertpreneur-connect.vercel.app/openapi.json

Authorization:
Bearer <ADPC_ACTION_TOKEN>

Only trusted private server integrations should use this route; never expose its bearer to marketplace users.

Connect an MCP client

Use the deployed MCP URL:

https://advertpreneur-connect.vercel.app/api/mcp

OAuth-capable clients can follow the Supabase OAuth discovery flow. Private clients may instead use the optional static MCP bearer when you deliberately configure one.

Verify the stack

Open /api/health and confirm the deployment is responding.
Open /openapi.json and confirm it reports the current public API version.
Connect a test WordPress site and verify it appears in list_sites.
Run site_status to confirm plugin capabilities.
Test content search/read before attempting any write.
Run a draft → quality checks → attestation → publish workflow end to end.