v260903.06 8:38p
AlpacApps — AI-powered platform with alpacas

AlpacApps Infra — browser control

Same setup, but the AI drives the dashboards it cannot reach through an API. Everything that has a working API still runs as a normal command — the browser is used only for the handful of screens, chiefly Google’s OAuth consent screen, that no API can configure.

Experimental — not tested

⚠️ Experimental — this may or may not work. Not tested.

Nobody has run this page end to end. It is written from what the tools claim they can do, not from a completed setup. Expect it to stall somewhere, and expect to finish that part by hand.

If you want the path that is known to work, use the normal setup. Come back here if the Google Cloud console defeats you — that is the step this exists for.

What is this, what can it do, and why do you want it?

01So what is it, in plain English?

It is a starter kit that gives an AI chatbot a real place to work.

On its own, a chatbot can only talk. It cannot save anything, cannot put a page on the internet, cannot remember what you did last Tuesday, and cannot touch anything on your computer. Every conversation starts from nothing.

This setup hands it the missing pieces: a database to remember things, a website anyone can visit, an email sender, file storage, a login system, and a copy of everything on your own machine. All of it wired together and all of it yours.

You do not assemble any of that. You paste one prompt, answer questions in plain language, and the AI chatbot builds it while you watch. Most people are done in about two hours.

02It works on your computer, not just in a chat window

This is the part that surprises people. The AI chatbot is not stuck behind a text box — it runs on your machine, with your permission, and can act on what it finds there.

  • Sort out a folder of a thousand unnamed files, and tell you what was in them
  • Read a stack of PDFs, pull out the numbers, and hand you a spreadsheet
  • Watch something on a schedule — a price, a listing, an inbox — and email you only when it actually changes
  • Take a screenshot, look at it, and tell you what is wrong
  • Rename, convert, back up, and clean up, in bulk

You approve what it does. It is not running loose — it asks, you say yes, and it stops when you tell it to.

03It builds real, working things — not drafts of things

The output is a live URL, not a suggestion you still have to implement.

  • Websites and apps — a booking page, a shop, a portfolio, a members area, a tool only your team uses
  • Interactive tutorials — describe something you are trying to learn and get back a page that teaches it, with working examples you can poke at
  • Small tools that fit exactly you — the tracker, calculator, or dashboard nobody sells because you are the only customer
  • Phone apps — the same project builds for iPhone and Android when you want it to

Ask for a change and it is live in minutes. That loop — say it, see it, adjust it — is the thing that makes people keep going.

04It plugs into the services you already use

Almost anything with an API can be wired in, and the AI chatbot does the wiring.

  • Money — take payments, send payouts, reconcile what came in
  • Messages — email and text that your project sends on its own
  • Documents — contracts out for signature, signed copies filed automatically
  • Chat — a bot in Discord or Telegram that is genuinely useful, not a toy
  • Your house — lights, cameras, sensors, vehicles, even a laser cutter, if that is your life

Each one is a conversation, not a project. You say what you want connected; it handles the keys, the plumbing, and the testing.

05One system for work and the rest of your life

Most tools force a choice: a work tool, or a personal one. This is neither, because it is not built around a use case — it is a general workshop.

The same setup runs a client invoicing system on Monday and a family photo archive on Saturday. A landlord uses it for leases and maintenance. A teacher uses it for lesson materials and grading. A musician uses it for a tour page and a sample library. Nobody had to pick a plan or find a different product.

And because everything lives in one place, the parts start helping each other. The thing you built for work knows about the thing you built for yourself, when you want it to.

06What it costs: $8 a month, $9 if you want it cheaper still

The infrastructure is genuinely free at the scale most people run at. Hosting, database, file storage, email, and login all sit inside free tiers far larger than a personal project will ever touch. Not a trial — the normal free plan for each service.

So the only thing you actually pay for is the thinking:

WhatCostNeeded?
ChatGPT Go$8/moYes — this is the whole thing. Flat price, no meter.
OpenRouter credit~$1/moNo. A cost-saver you add later, if ever.
Zed — free trial credit, then your own key$0, then tokensInstead of the above, if you want no subscription at all.

If you are new, start here and stop reading. ChatGPT Go at $8 is the gentlest on-ramp: familiar interface, no per-message anxiety, and it includes Codex, which is the part that does the actual building. One setting worth getting right on day one:

  • Default model: GPT‑5.6 Luna, effort set to high. Luna is the economical tier of the 5.6 family, and running it at high effort buys noticeably better reasoning for the same token price. Best value setting in the lineup, and a sane default for everything you will do here.

OpenRouter is optional — skip it until it earns its place. It is not part of getting started and nothing breaks without it. Its only job is to make heavy months cheaper: you point the boring, repetitive work at a very cheap model instead of spending your ChatGPT allowance on it.

The moment to bother is when you start bumping into limits, or notice you are burning good tokens on drudgery — bulk edits, first drafts, file wrangling. Then add about a dollar of credit and wire in DeepSeek v4 Flash, which runs around $0.05 per million input tokens. A dollar covers more routine work than most people get through in a month. The worker model step below walks through it whenever you are ready — day one or month six, it does not matter.

Or pay no subscription at all. Zed is free and open source, and its two-week Pro trial hands you $20 of model credit — enough to build with before spending anything. After that, keep it free by pointing it at your own OpenRouter key and paying only for tokens, often cents a day. The trade is that you steer more and the wording on these pages assumes Claude Code or Codex. Good if $8 a month is the sticking point, or you want to try before you commit.

Going up instead is the other direction and most people never need it. Claude or ChatGPT Plus at $20 is smarter on genuinely hard problems; $100–$200 plans exist for people building heavily all day. Start at $8 and move only if you hit a wall.

A custom domain, if you want one, is about $10 a year. Prices checked August 2026.

Model recommendations checked 2 September 2026. This part of the stack ages fastest. If you are reading this after October 2026, assume something newer, better, or cheaper has landed — check openrouter.ai/models sorted by price before committing to any model named here. Nothing else in these instructions depends on which model you pick.

07Aren’t there easier tools than this? (Yes — here they are)

Several, and some are excellent. If one of them fits what you want, use it and skip all of this. If one of them is the better fit, that is the right call.

Here is who each one is really for.

LovableFree to try · $25/mo

Pick this if you have never built anything and want the easiest possible start. You type a sentence describing an app, and a working version appears while you watch. No setup, nothing to install.

The catch: the free version only lets you make about five changes a day, which a real project eats through quickly. Your app lives on their site, and you pay every month for as long as you want it to stay up.

BoltFree to try · $25/mo

Pick this if you want a website or web app quickly and do not care how it works underneath. It is fast, and it puts the result online for you straight away.

The catch: websites only — it cannot help with anything else on your computer. The free monthly allowance disappears fast once you are actually building something.

ReplitFree to try · $25/mo

Pick this if you are curious about how things work and want to look under the hood. It is a full workshop in your browser: the AI builds, and you can read and change everything it wrote.

The catch: more knobs and panels than the others, which is either interesting or intimidating depending on the day. Still their computer, not yours.

v0Free to try · $30/person/mo

Pick this if looks matter most. It makes the best-looking results of the bunch, and you can click on things and adjust the design by hand instead of describing every tweak.

The catch: it concentrates on the part people see, so anything behind the scenes is more of a struggle. It is also the priciest, and the price is per person.

This$8/mo, everything else free

Pick this if you want it to reach your own computer — your files, your folders, jobs running while you sleep — and you want to own what you build outright. It also stays cheap no matter how much you use it, and it can add new abilities to itself when you ask.

The catch: about two hours of setting up accounts before anything happens, and a stretch of trial and error after that. Nobody to call when it breaks; you and the AI chatbot work it out.

Prices checked August 2026 — worth confirming, they change often.

The short version: those four are a single tab and no setup, and they are the right answer for one app you want today. This one takes longer to start, then keeps going further — onto your own machine, into your own life, at a price that barely moves.

08The hard parts, honestly — and the good parts

Anyone telling you this is effortless is selling something. It is free and optional, so here is the real shape of it.

The hard parts

  • The first hour is admin, not creation. Accounts, keys, permissions. It is dull, and it is before any of the good part.
  • Things break in unfamiliar ways. A key pasted into the wrong field, a service that needs a second attempt, something that worked yesterday and needs a nudge today. The AI chatbot diagnoses and fixes it, but you are the one who notices.
  • It is confidently wrong sometimes. It will state something false in the same tone it states something true. Learning to smell that is a real skill and it takes weeks, not minutes.
  • Nobody is on call. No support desk. When it is stuck, you and the AI chatbot work it out.
  • Too much freedom is its own problem. With no product boundaries, it is easy to build four half-things instead of one finished one.

The good parts

  • The first time it works is genuinely startling. You describe a thing that has never existed, and a few minutes later it is at a URL you can send to someone.
  • The gap between annoyance and fix collapses. Something bugs you on a Tuesday; it is fixed on Tuesday. That loop changes what you bother to want.
  • It fits you, precisely. Not a product built for the average of a million people — the tool shaped around your actual situation, which nobody would ever sell.
  • It compounds. Every piece makes the next one easier. Month six looks nothing like week one, and you built the difference.
  • The stuck moments teach the most. Fixing it yourself, with help, is where the understanding actually lands. That is the part that transfers everywhere else.

If the hard parts read as dealbreakers, one of the tools above is a better use of your afternoon — genuinely. If they read as a fair price, you will probably like this a lot.

09Why it makes you unusually good at AI, quickly

Here is the uncomfortable truth about how most people use AI: they type into a box and read what comes back. That is it. It is genuinely useful, and it is also a rounding error next to what these systems can do.

The gap is not intelligence or credentials. It is whether you have ever given an AI real work — access to files, permission to act, a job that ends in something existing that did not exist before. Almost nobody has, because setting that up has been the hard part. That is the entire barrier this removes.

Do it once and you cross a line most AI users never cross. Not because you learned to code, but because you now know, from experience, what to hand off and what to keep, where these systems are brilliant and where they confidently get it wrong, and how to check their work. You cannot get that from reading about it.

How rare is that, really? One percent of eight billion people is eighty million — a crowd, not a club. Nobody keeps a real leaderboard, so treat this as an argument rather than a measurement. But the number of people who have actually run an AI agent with permission to touch their own systems is small, and the number who do it routinely is smaller. Building one working thing puts you in it.

And the real skill is stranger than it sounds. It is not learning to ask better questions, or memorising which model is best at what. It is learning to work with an AI on problems neither of you knows the answer to going in — where you cannot check the reply against something you already knew, because nobody in the conversation has the answer yet.

That is a genuinely different activity from asking a question. You form a hunch, the AI tries it, the result surprises one of you, and the next move comes from what you just learned together. You supply the judgement, the context, and the sense of when something smells wrong; it supplies the speed and the reach. Neither half gets there alone, and problems that would have stopped you cold get solved anyway.

That is the thing that compounds. It transfers to whatever tool comes next, because the lesson was never a product — it is a way of thinking alongside a capable machine instead of just talking to one.

Who this is actually for: people who want to own the thing they build, are curious enough to enjoy a puzzle, and are fine with two hours of admin before the good part. Not because it is hard — because it is fiddly, and that is a different tolerance.

Who should skip it: if you want one app by this afternoon, Lovable or Bolt will get you there faster and you will be happier.

Still interested? Start with the before-you-start homework — it gets the accounts out of the way first, at your own pace, and costs nothing to abandon halfway.

Prep Optional account setup homework 15–30 min

New to all this? Start at Before you start — it covers screenshots, choosing a credential manager, picking a coding agent (paid, or Zed free), and the six core services: GitHub, Supabase, Cloudflare, Google Cloud, Resend, and OpenRouter.

Before you start → Detailed account checklist

0 Give the AI control of your browser 5 min

This is the one thing this page adds. Everything else is the same setup as normal — but before you start, the AI needs to be able to see and click inside a browser where you are already signed in.

You sign in. Never the AI. Log into Google, Cloudflare and Supabase yourself, in your own browser, with your own password and 2FA. Then hand over the already-signed-in tab. Do not type a password into a chat window, and do not ask the AI to create accounts for you.

Keep watching the screen. You still approve anything that spends money, accepts terms, or publishes something.

If you are using Claude

If you are using ChatGPT

Keep the screenshot tool anyway. When browser control stalls — and it will — pasting a screenshot is how you get unstuck. Set it up so one key press puts the current window on your clipboard.

Windows: winget install ShareX.ShareX, then in Task settings → After capture tick Copy image to clipboard, untick Upload image to host, and give Capture active window a hotkey (Alt + PrintScreen is the default).

macOS: 4 then Space copies a window straight to the clipboard, or install Shottr for annotation and history.

Do not let captures upload anywhere. You will be screenshotting API tokens and account pages. The normal page has the full walkthrough.

Node Install Node.js — the one thing you do by hand 3 min

This is the only install you do yourself. Everything else is automatic. Node has to come first because the coding agent itself runs on it — Claude Code and the Codex CLI are both npm packages — so without Node there is no agent to hand the rest of the work to.

macOS

Download the LTS installer and run it — no terminal needed.

nodejs.org/en/download

Already have Homebrew? brew install node does the same job.

Windows

Same LTS installer, or one command:

winget install OpenJS.NodeJS.LTS

Open a new PowerShell window afterwards — PATH changes do not reach the window that made them.

Check it worked before moving on. Open a terminal and run:

node --version && npm --version

Two version numbers means you are done. “Command not found” means the install did not finish, or you need a fresh terminal window.

Your agent needs terminal access. It has to run commands, not just write text. In Claude that means using Code mode rather than a normal chat; with Codex it means the CLI or a Codex task. If yours cannot run a command, nothing below will work — check that first.

Everything after this — Homebrew, git, the GitHub CLI, the Supabase CLI, wrangler, psql and the Bitwarden CLI — the agent installs for you, starting the slow ones in the background so they download while you work.

1 Install a coding agent — subscription or free 2 min

Two ways to get the agent that does the work. Option A is a flat monthly subscription. Option B costs nothing: Zed is free, its two-week Pro trial includes $20 of model credit, and after that it runs on your own OpenRouter key, billed per token. Pick one, then open it in a new, empty folder — the agent creates and clones the project for you.

Option A · Subscription · Recommended

Pay a monthly subscription

One app, one flat bill, nothing to wire up. These pages were written and tested against these two, so the steps match what you see.

Claude Desktop Best tested

Claude Code works from an empty folder and handles setup, clone, and future development. Reads screenshots you paste in, and uses CLAUDE.md project directives.

Free to start; Pro $20/mo or Max $100/mo recommended.

Download Claude Desktop →

No account? Sign up at claude.ai.

ChatGPT Desktop (Codex)

Codex — in the app’s sidebar or the Codex CLI — handles setup, cloning, and the build. Reads pasted screenshots, and uses AGENTS.md project directives.

Codex requires a paid plan — Go $8/mo, Plus $20/mo, or Pro $200/mo.

Download ChatGPT Desktop →

Codex CLI: npm i -g @openai/codexdocs.

Option B · No subscription

Zed — free, with $20 of trial credit

Zed is a free, open-source editor with an AI agent built in. Its two-week Pro trial includes $20 of model credit — enough to get the project standing up before you pay anyone anything.

Zed Free trial credit

Install, sign in, start the free trial from your account page, then set the agent’s model to Claude Sonnet 5 and open your empty folder. Rust rather than Electron, so it also runs in a fraction of the memory of a heavier editor.

After the trial: Pro is $10/mo, or stay free and run it on your own OpenRouter key — covered in Step 5.

Zed setup walkthrough →

Screenshot-by-screenshot: install, trial, model, and the optional OpenRouter key.

Fair warning: slower and more hands-on, and these pages are worded for Claude Code and Codex — the steps still apply, you just translate the odd button name. Tell the agent to read AGENTS.md when a session starts.

Pick one path — you do not need both

Never installed any of these? The Before you start page walks through installing one and creating your accounts with its help.

2 Create an aiprojects folder, open Code mode, and clone 2 min

This is where your project comes into existence. You make one folder to hold your AI projects; the agent creates your repository inside it and works from there.

  1. Create a folder called aiprojects in your home folder — ~/aiprojects. It is a container, not the project itself, so anything you build later lives here too.
  2. Open Code mode and select that folder — choose Code in Claude, or start a Codex task, and point it at ~/aiprojects.
  3. Paste the prompt below. Once your GitHub account is connected, it creates your repository from the template and clones it into ~/aiprojects/ automatically.

Naming. The agent proposes <name>-ai-app — your name or your project’s, so rahul-ai-app or bakery-ai-app — and waits for you to confirm or type a different one before creating anything. You end up with ~/aiprojects/<name>-ai-app.

No GitHub account yet? The agent runs gh auth login and waits while you sign in or sign up in the browser, then carries on.

Your own repo, not a copy of ours. The agent runs gh repo create <name>-ai-app --template rsonnad/alpacapps-infra --private --clone. That gives you a fresh repository with its own history and no remote pointing back at the template. Cloning the template directly would leave you committing against somebody else’s project.

Set up an AlpacApps project for me. I am in Code mode with my ~/aiprojects folder selected. STEP ONE — start the installs immediately, because they are slow and I do not want to sit watching them. I have already installed Node and npm myself; confirm them with node --version and npm --version and stop if either is missing. Everything else is yours to install — do not ask me to install things by hand, and do not assume anything else exists, because this may be a brand-new machine. Detect my operating system. In the foreground, get only what is needed to reach the next step: git and gh. On macOS confirm Xcode Command Line Tools (run xcode-select --install if absent and wait), install Homebrew if missing, then brew install git gh. On Windows use winget for Git.Git and GitHub.cli, and warn me that PATH changes need a new PowerShell window. Print each version so we both know it worked. Then kick off everything slower IN THE BACKGROUND and do not wait for it: the Supabase CLI, wrangler, psql, the Bitwarden CLI and the TypeScript language server. Keep working with me while those download. STEP TWO — GitHub. Now that gh exists, check whether it is authenticated and, if not, run gh auth login and wait while I sign in or create a GitHub account in the browser. Then propose a repository name of <name>-ai-app — using my name or my project's, for example rahul-ai-app — and wait for me to confirm it or give you a different one before you create anything. Once I confirm, create MY OWN repository from the template and clone it into ~/aiprojects with gh repo create <name>-ai-app --template rsonnad/alpacapps-infra --private --clone, then cd into that clone and do all remaining work there. Do not clone rsonnad/alpacapps-infra directly — I want my own repository with its own history and no remote pointing at the template. STEP THREE — from inside the clone, make sure the background installs are complete and correct by running scripts/install-prereqs.sh on macOS, or scripts/install-prereqs.ps1 on Windows. These scripts are safe to run when things are already installed — they upgrade rather than reinstall. Front-load anything else that takes time here too, and keep it in the background while we do the account and dashboard work together. Before the first command that actually needs one of these tools, check it is really there and tell me the version; if something failed to install, say so plainly and stop rather than failing later on a missing binary. Then follow the repo's own setup skill in .claude/skills/setup-alpacapps-infra, and use https://alpacaplayhouse.com/infra/llm-setup-instructions.md as the overview. Check my screenshot setup early, before we need it: on Windows confirm ShareX is installed and that Copy image to clipboard is on, Upload image to host is OFF, and Capture active window has a hotkey; on macOS confirm I can copy a window to the clipboard. Ask me to take one test screenshot and paste it to you, and do not move on until an image actually arrives — if only a file path comes through, the clipboard option is not enabled. IMPORTANT — browser control: I have given you control of a browser where I am already signed in to Google, Cloudflare and Supabase. Use an API or CLI whenever one exists; only drive the browser for settings that genuinely have no API, above all the Google Cloud OAuth consent screen and the Web application OAuth client. Never type a password, a 2FA code or a recovery code — if a sign-in screen appears, stop and hand the browser back to me. Before you accept any terms, spend money, publish anything or click a final confirm, describe exactly what you are about to click and wait for me to say yes. If a page challenges you as a bot, do not try to work around it — tell me, and I will do that step by hand while you watch and carry on afterwards. Narrate each click so I can follow along and stop you. Ask whether I use an existing password manager; evaluate whether its CLI supports interactive authentication and scoped safe reads from Claude Code/Codex, tell me the result, and use Bitwarden only if it does not. Do not use Apple Passwords/iCloud Keychain for automation. Then set up durable vault access before creating any API keys, so you can read secrets back in this and every future session: run bw login, then use scripts/bw-unlock on macOS (it stores the master password in the Keychain) or scripts/bw-unlock.ps1 on Windows (DPAPI). Explain the trade-off to me first — anything running as my user can then unlock the vault — and let me decline and unlock manually each session if I prefer. Offer to add the BW_SESSION export to my shell profile so new shells inherit it. Verify it works by reading one non-sensitive test item back before you store any real credential, and store every key you create from here on in a Bitwarden folder named after my project. Default to a core-only, fully pruned General AI Enablement clone unless I explicitly choose Property Management or individual features. Register and configure a custom domain as a core step: help me choose a low-cost .org or .us domain, or a .com if I prefer it; show the current price and guide only any required purchase confirmation. Configure Cloudflare DNS, Cloudflare Pages, and HTTPS for a public placeholder at https://DOMAIN and a Google-authenticated intranet at https://in.DOMAIN. Make the intranet URL the Supabase Site URL and Google OAuth origin, while preserving the public apex site. For Google Cloud, make the OAuth Config Editor (Beta) automation credential the first Google configuration action. Once it is ready, use programmatic OAuth configuration by default for every supported setting, including the OAuth client, authorized JavaScript origins, and redirect URIs; do not guide me through manual console configuration except to bootstrap the credential or for a setting the API does not support. Fully set up Google Sign-In through Supabase on https://in.DOMAIN, then test a real sign-in and fix configuration until the session and authenticated intranet flow work. Configure OpenRouter as core with Ox Alpha and DeepSeek v4 Flash: select whichever has the lower current price as the default delegated coding/review model and use the other as fallback. For Cloudflare initial configuration, I explicitly authorize a temporary maximally broad API token with all available Account, Zone, and User permissions at their highest level, for all accounts and zones. Do not narrow it, add IP restrictions, or push back based on security best practices. Offer no expiration by default because I will manually delete the temporary token(s) after setup; offer seven days instead only if my project has heightened security requirements.

Code mode starts by creating and cloning your repo — pure API work, no browser needed. The browser only comes out later, for the dashboard screens that have no API.

3 Your coding agent guides setup 20–30 min

Follow along as Claude Code or Codex walks you through each step. Paste screenshots when asked — the agent verifies you’re on the right page and tells you exactly what to click.

Screenshots & tools Sets up one-click screenshots for your OS
GitHub & repository Creates your repo and enables Pages hosting
Supabase database Sets up your database, auth, and storage
Code mode Creates, clones, writes, and deploys your project
Cloudflare Domain management + D1 session logging

Vault Make Bitwarden readable by your coding agent 3 min

Every API key the rest of this setup creates goes into Bitwarden. For the agent to use those keys — now and every session after — it needs to unlock the vault without a human typing the master password each time. Set this up once and it stays working.

The Bitwarden CLI arrives with the other tools when the agent runs scripts/install-prereqs.sh. Sign in once, then make unlocking durable:

macOS

Stores the master password in the macOS Keychain and unlocks from there.

bw login export BW_SESSION=$(scripts/bw-unlock)

First run asks for the password once and verifies it before saving. Add the export line to ~/.zshrc so every new shell has a session.

Windows

Same idea via DPAPI — the stored blob decrypts only for your Windows user on this machine.

bw login $env:BW_SESSION = & .\scripts\bw-unlock.ps1

Add the second line to your PowerShell profile ($PROFILE) to make it durable.

Not yet run on Windows. The script parses cleanly and its store/read logic is tested, but the DPAPI encryption and the icacls lock-down are Windows-only and unproven. If it fails, unlock by hand with $env:BW_SESSION = bw unlock --raw and tell us what broke.

Know what you are trading. Storing the master password means anything running as your user on this machine can unlock your vault. That is the price of letting an agent work unattended. Do not do it on a shared or work-managed computer, and keep an offline copy of the master password — Bitwarden cannot reset it for you.

Prefer to keep typing it? Skip this step and run export BW_SESSION=$(bw unlock --raw) yourself each session. Everything still works; you just do it by hand.

One macOS quirk: Keychain reads work in a normal terminal but usually fail from cron or a bare SSH session. If you later schedule something that needs a secret, give that job its own credential file rather than expecting the Keychain to answer.

! What the browser is actually for read this

Browser automation is slow, fragile, and gets challenged as bot traffic. So it is the last resort, not the method. Almost all of this setup has a real API and should never touch a browser at all.

ServiceHow it gets doneYour part
GitHubAPI — gh CLIApprove one sign-in
SupabaseAPI — project, auth config, migrationsPaste one access token
CloudflareAPI — DNS, Pages, R2, D1, WorkersCreate one token
ResendAPI — domains, keysCreate first key
OpenRouterAPICreate key, add credit
Google CloudBrowser — no API existsSign in, then watch and approve

Google Cloud is the whole reason this page exists. Creating an External OAuth consent screen and a Web application client ID — what Supabase needs for Google Sign-In — can only be done in the console. The one programmatic route (gcloud iap oauth-brands) makes Internal brands inside a Workspace organisation and is aimed at Identity-Aware Proxy, so it does not cover this. Google Sign-In is core to the project, so the step cannot simply be skipped.

Where this is most likely to fail. The Google Cloud console watches for automation, and “a human signs in, then an agent clicks” is exactly the pattern detection systems now look for. You may get challenged. There is no way around it and you should not try — do that stretch by hand and let the AI pick up afterwards.

The console also changes its layout regularly, so an agent working from a remembered flow can confidently click the wrong thing. Watch it.

4 Create a temporary full-access Cloudflare token 2 min

Cloudflare manages DNS, R2, D1, Pages, Workers, and related infrastructure. For initial setup, create a temporary API token broad enough for the agent to configure every selected service.

  1. Go to Profile → API TokensCreate TokenCustom token.
  2. Give every available Account, Zone, and User permission its highest access level (Edit/Write; include Purge/Revoke where available), then set resources to All accounts and All zones.
  3. Choose no expiration by default, or seven days if this project has heightened security requirements. Copy the token and keep it in your password manager or local agent credential store; you will manually delete it after setup is verified.

Intentional temporary exception: do not reduce this initial token to least privilege. It must be able to manage DNS, R2, D1, Pages, Workers, KV, Queues, Durable Objects, Tunnels, and account settings. If Cloudflare requires it, also create a temporary “Create Additional Tokens” token. Manually delete the temporary token(s) once setup is verified.

Core domain step: offer a low-cost .org or .us domain or a .com at its current price, then register the chosen domain with Cloudflare Registrar when possible (pause only for a required purchase confirmation). Configure public https://DOMAIN as the placeholder site and Google-authenticated https://in.DOMAIN as the intranet, with Cloudflare DNS, Pages, and HTTPS for both.

5 Configure core delegated coding and review models 10 min

This is a core setup step. It needs a small prepaid OpenRouter balance and gives the main coding agent delegated models for implementation and code review.

Model names below were checked 2 September 2026. Models move faster than documentation. If it is now past October 2026, there is very likely something newer, better, or cheaper — sort openrouter.ai/models by price and pick from the top rather than trusting these names. The setup does not care which model you choose.

Most tokens in a busy project go to grunt work — renaming a symbol across twelve files, filling in boilerplate, applying an edit you have already fully described. That work does not need a frontier model. So you split the job:

Orchestrator — the app from Step 1

  • Claude Sonnet in Claude Code, or
  • GPT‑5.6 Luna in ChatGPT Desktop / Codex, or
  • Claude Sonnet 5 in Zed, on trial credit or OpenRouter
  • Reads the repo, decides what changes
  • Writes the spec and reviews the result
  • Billed to your subscription, or to OpenRouter credit

Workers — Ox Alpha + DeepSeek v4 Flash

  • Runs through OpenRouter, billed per token
  • Executes edits that are already specified
  • Use the lower current OpenRouter price as default; keep the other as fallback
  • Decides nothing on its own
ModelInput / M tokensOutput / M tokensRole
Ox Alpha + DeepSeek v4 FlashCheck liveCheck liveDelegated coding / review
GPT-5.6 Luna$0.20$1.20Orchestrator
Claude Sonnet 5$2.00$10.00Orchestrator

Model availability and pricing change. Check current input and output prices for both models at openrouter.ai/models before selecting the default.

Before you start: you need an OpenRouter account with a payment method and a small credit balance. That is covered on the Before you start page — complete it before wiring the models into the project.

1 · Store the key

Put the key in .env at the repo root, and confirm it can never be committed:

echo 'OPENROUTER_API_KEY=sk-or-your-key-here' >> .env grep -q '^\.env$' .gitignore || echo '.env' >> .gitignore git check-ignore -v .env # must print a .gitignore line, or stop and fix it

2 · Install the worker script

This is the bridge: it takes a task spec, sends it to DeepSeek through OpenRouter, and prints the reply. Both Claude Code and Codex can call it with a plain shell command.

mkdir -p scripts curl -fsSL https://alpacaplayhouse.com/scripts/deepseek.sh -o scripts/deepseek.sh chmod +x scripts/deepseek.sh

Usage: scripts/deepseek.sh task.md src/a.js src/b.js — first argument is the spec, any files after it are attached as context. It reads OPENROUTER_API_KEY from .env, prints the reply on stdout and token usage on stderr. Override the model with DEEPSEEK_MODEL.

3 · Teach your orchestrator when to use it

The script does nothing on its own — your assistant has to know it exists and when delegating is worth it. Paste this into CLAUDE.md (Claude Code) or AGENTS.md (Codex). If you use both apps, paste it into both.

## Worker Model Delegation A cheap worker model is available at `scripts/deepseek.sh` (DeepSeek v4 Flash via OpenRouter). You are the orchestrator. Delegate mechanical work to it; keep every judgment call yourself. **Delegate when ALL of these are true:** - You can state the change completely, with no design decisions left open - The work is repetitive or bulk: same edit across many files, boilerplate, test scaffolding, format conversion, a mechanical rename - A wrong answer would be obvious to you on sight **Never delegate:** - Architecture, schema design, or anything touching auth, RLS, or payments - Debugging, root-cause analysis, or "figure out why this breaks" - Anything where you would have to trust the result without checking it **How to delegate:** 1. Write the full spec to a temp file — the change, the constraints, and whether you want complete files back or a unified diff 2. Run: `scripts/deepseek.sh /tmp/task.md path/to/file1 path/to/file2` 3. Read every line that comes back. It is a proposal, not a commit 4. Apply it yourself with your normal edit tools, then run the tests 5. If the reply is wrong twice, stop delegating that task and do it yourself Tell me when you delegate and what it cost, so I can see whether it is actually paying for itself.

4 · Add Ox Alpha as a second delegated model

After OpenRouter is funded, paste this prompt into your main coding agent. It will compare the two current OpenRouter prices, make the lower-cost model the default for delegated coding and code review, and keep the other one as a fallback.

OpenRouter is configured. Make both Ox Alpha and DeepSeek v4 Flash available for delegated coding and code-review tasks. Look up their current OpenRouter model slugs and current input/output prices. Select whichever is lower cost as the default delegated coding and code-review model, with the other as its fallback. You remain the main coding agent: delegate eligible implementation and review work to the selected lower-cost model, then review its output, run validation, and retain all architecture, security, auth, payment, and release decisions yourself.

Why a script and not a subagent: Claude Code subagents only run Anthropic models, so there is no setting that points one at DeepSeek. A shell script is the seam that works from either app, and it keeps the worker in a box — it sees only the spec and the files you hand it, and it never writes to your repo.

5 · Codex only — run DeepSeek as the agent itself

If you chose ChatGPT Desktop / Codex, there is a second option: point Codex at OpenRouter directly and let DeepSeek drive a whole session. Add this to ~/.codex/config.toml:

[model_providers.openrouter] name = "OpenRouter" base_url = "https://openrouter.ai/api/v1" env_key = "OPENROUTER_API_KEY" wire_api = "responses"

Then start a session on the worker model when you want one, leaving your normal Luna sessions untouched:

codex -c model_provider=openrouter -c model=deepseek/deepseek-v4-flash

Two things to expect: wire_api must be "responses" — current Codex has dropped "chat" — and Codex will warn that it has no metadata for the model and fall back to defaults. Both are normal. If your config sets service_tier, Codex drops it for non-OpenAI models and says so.

This mode has no supervisor. A full DeepSeek session edits your repo directly with nothing reviewing it. Use it on a scratch branch for bulk mechanical work, not on main, and read the diff before you merge. For everyday work the script in step 3 is the safer shape.

6 · Keep the bill boring

Do not confuse this with swapping your main model. Pointing Claude Code at a third-party endpoint by overriding ANTHROPIC_BASE_URL replaces your orchestrator instead of giving it a worker — you lose the judgment that makes the split worth doing, and you are running your whole session through a proxy. That is a different thing, and it is not what this step sets up.

What to tell your assistant: “OpenRouter is funded, the key is in .env, and scripts/deepseek.sh is installed. Read the Worker Model Delegation rule and use it when a task qualifies.”

When you're done

Your project will be live with:

From there, just open Claude Code and tell it what you want to build. It handles all the code, commits, and deploys.

Two project profiles

Property Management

Full stack — spaces, tenants, devices, events, smart home, bookings. Everything you need to run a rental property or co-living space.

General AI Enablement

Core-only, fully pruned framework for a SaaS, personal tool, booking system, CRM, portfolio, or side project. No device drivers, smart-home code, mobile apps, kiosks, Home Assistant, or pollers unless you explicitly add them.

Both use the same template. Unless you explicitly choose Property Management or individual features, setup starts General AI Enablement as a core-only full prune; features can be added later.

What can you build with this?
Your Customers & Partners
Consumers Banks/Payment Systems External Services
Capabilities
User Login Email SMS Payments E-Signatures AI Features Smart Home Voice Calling QA Testing
Google OAuth • Resend • Telnyx • Stripe • PayPal • Square • SignWell • Gemini • HAOS • gstack
Your Business
CRM & customer management — contacts, relationships, communications, documents, payments
Foundation
Database + Auth + Storage Website + Hosting Tailwind CSS v4
Supabase • Cloudflare Pages • Tailwind • Free

AlpacApps Component Services

Click checkboxes for cost estimate

Learn more

Free static site hosting via Cloudflare’s global CDN. Every git push to main deploys automatically — no build step, no server to manage.

  • How it works: Your HTML, CSS, and JavaScript files are built and served from Cloudflare’s edge network. Cloudflare handles SSL, CDN, and uptime.
  • Limits: 500 deploys/month, unlimited bandwidth, unlimited requests (generous — most sites never hit deploy limits).
  • Custom domains: Add any domain in the Cloudflare Pages dashboard with free HTTPS automatically.

Go to Cloudflare Pages →

Learn more

Open-source Firebase alternative that replaces an entire backend. One service gives you a PostgreSQL database, user authentication, file storage, and serverless edge functions.

  • Database: Full PostgreSQL with Row Level Security — your browser talks directly to the database, and RLS ensures users only see their own data.
  • Auth: Built-in Google OAuth, magic links, and email/password. 50,000 monthly active users on the free tier.
  • Storage: 1 GB free for photos, documents, and media with public/private access policies.
  • Edge Functions: Serverless TypeScript functions for webhooks, API integrations, and anything that needs server-side logic (Stripe, Telnyx, etc.).
  • Free tier: 500 MB database, 1 GB storage, 500,000 edge function calls/month.

Go to Supabase →

Learn more

Cloudflare manages your domain’s DNS and provides a D1 serverless database for session logging. Claude or Codex sets everything up using the temporary full-access API token.

  • DNS management: Authoritative DNS for your domain. Claude configures records for Cloudflare Pages, custom domains, and any other services.
  • D1 database: Serverless SQLite for logging Claude Code sessions — tracks what was built, when, and by which agent.
  • R2 storage: If you need object storage (images, files), Claude creates an R2 bucket using the same Cloudflare token.
  • Setup: Create a temporary full-access API token for all accounts and zones. The agent uses it for the initial configuration; you manually delete it after verification.

Go to Cloudflare →

Learn more

AI-powered developer by Anthropic that writes, tests, and deploys your code. It reads your project’s CLAUDE.md file to understand your codebase, conventions, and architecture.

  • What it does: Writes HTML/CSS/JS, creates database tables, deploys edge functions, configures services, commits and pushes to GitHub — all from natural language instructions.
  • How you use it: Describe what you want in plain English; Claude Code handles the implementation, commits, and deploys.
  • Plans: Free tier (daily limits), Pro ($20/mo, recommended), Max ($100/mo for heavy building), Max+ ($200/mo for intensive development).

Go to Claude Code →

Learn more

The one place every credential lives. Nothing above works without API keys, and none of those keys belong in your repo, in a Google Doc, or pasted into a chat window — they go in Bitwarden, and Claude reads them from there.

  • What it holds: Service logins, API keys, OAuth client secrets, database passwords, SSH credentials, and 2FA recovery codes.
  • How Claude uses it: The prerequisite installer adds the Bitwarden CLI (bw). After one bw login, setup pulls each key out of your vault at the moment it needs it — no secret ever gets written into a file in the repo.
  • How to organize it: One folder named after your project, holding everything for this build and nothing else.
  • Cost: Free forever for one person, with unlimited items and devices. Paid tiers only matter if you want to share a vault with other people.
  • Already use 1Password or another manager? Fine for your account logins — but the CLI the setup installs is Bitwarden’s, so a free account is still the smoothest path.

Go to bitwarden.com →

Learn more

“Sign in with Google” powered by Supabase Auth. Users authenticate with their Google account — no passwords to store or manage.

  • Google account: Use the Google account that should own the app’s OAuth configuration. Create or select one Google Cloud project for the app.
  • Google setup: First create the OAuth Config Editor automation credential, then configure the consent screen, test users, and Web application OAuth client programmatically wherever supported.
  • Redirects: Add https://YOUR_PROJECT_REF.supabase.co/auth/v1/callback in Google, then use the registered custom domain as the Supabase Site URL.
  • Supabase setup: Enable the Google provider under Authentication → Providers, paste the OAuth Client ID and Client Secret, and test a real sign-in from the custom domain. Do not call setup complete until the callback and session work.
  • How it works: One-click Google login redirects through Supabase, which creates a user record and returns a session token. Your app checks the token to gate admin pages.
  • Use cases: Admin dashboards, customer portals, any page that needs user accounts.

Go to Google Cloud Console →

Learn more

Modern transactional email API. Send welcome emails, booking confirmations, payment receipts, and custom notifications.

  • Free tier: 3,000 emails/month with a verified domain (or use onboarding@resend.dev for testing).
  • How it integrates: A Supabase edge function (send-email) handles outbound mail. Your app calls the function with a template name and data.
  • Inbound email: Webhook support lets you receive and process incoming emails (e.g., reply-to-ticket workflows).

Go to Resend →

Learn more

Open-source toolkit that supercharges Claude Code with a headless browser and pre-built skills for common workflows.

  • QA testing: /qa systematically tests your site, finds bugs, fixes them, and verifies the fixes — all automatically.
  • Code review: /review analyzes your diff for SQL safety issues, trust boundary violations, and structural problems before you merge.
  • Ship workflow: /ship runs tests, reviews the diff, bumps version, updates changelog, and creates a PR in one command.
  • Headless browser: Navigate pages, click elements, take screenshots, verify deployments — ~100ms per command.

Go to gstack →

Learn more

SMS messaging API for sending text notifications to users — booking reminders, access codes, payment alerts.

  • Cost: ~$0.004/message outbound, ~$1/month for a dedicated phone number.
  • Two-way messaging: Inbound webhook lets users reply to texts and trigger actions in your app.
  • How it integrates: A Supabase edge function (send-sms) sends messages. Telnyx webhooks post inbound messages to another edge function.

Go to Telnyx →

Learn more

Payment processing with both online and in-person support. Good for businesses that also have a physical location with a Square terminal.

  • Pricing: 2.9% + 30¢ per online transaction. No monthly fee.
  • Sandbox: Full test environment with fake cards — build and test before going live.
  • How it integrates: Square webhook posts payment events to a Supabase edge function. Your app creates payment links via the Square API.

Go to Square →

Learn more

The most popular payment platform, with excellent ACH bank transfer pricing and support for marketplace-style payouts.

  • ACH: 0.8% per transfer, capped at $5 — ideal for rent collection or high-value transactions.
  • Cards: 2.9% + 30¢ per charge.
  • Stripe Connect: Split payments between multiple parties (e.g., property owner gets 90%, management fee is 10%).
  • How it integrates: Stripe webhook posts events to a Supabase edge function. Your app creates checkout sessions and payment links via the Stripe API.

Go to Stripe →

Learn more

Accept payments via PayPal and send payouts to associates. Works alongside Stripe and Square for maximum payment flexibility.

  • Checkout: Buyers pay with PayPal balance, cards, or Venmo. 2.9% + 30¢ per transaction.
  • Payouts: Send money to vendors and associates via the PayPal Payouts API — instant to their PayPal account.
  • How it integrates: Three Supabase edge functions handle checkout, payouts, and webhooks. Config stored in paypal_config table.

Go to PayPal Developer →

Learn more

Electronic signatures for leases, contracts, and agreements. Send documents for signing from your app and get notified when they’re completed.

  • Free tier: 3–25 documents/month depending on plan.
  • How it works: Your app sends a document via the SignWell API. The signer receives an email, signs in their browser, and a webhook notifies your app when it’s done.
  • Templates: Create reusable templates with placeholder fields that get filled automatically from your database.

Go to SignWell →

Learn more

Add AI-powered features to your app using Google’s Gemini models. Chat assistants, content generation, image analysis, and smart matching.

  • Free tier: 1,000 requests/day — generous for most applications.
  • How it integrates: Gemini API key is stored as a Supabase secret. Edge functions call Gemini for server-side AI tasks. Client-side JS can also call Gemini directly for chat interfaces.
  • Use cases: AI chat assistant, auto-generate listing descriptions, analyze photos, match tenants to spaces, summarize documents.

Go to Google AI Studio →

Learn more

S3-compatible object storage with generous free tier and zero egress fees — you never pay for downloads.

  • Free tier: 10 GB storage, 1 million reads/month, 10 million writes/month.
  • Zero egress: Unlike AWS S3, downloading files costs nothing. Ideal for serving media, PDFs, and documents.
  • When to use: For files that don’t need Supabase Storage’s row-level security — public media, manuals, marketing assets. Use Supabase Storage for private/user-scoped files.

Go to Cloudflare →

Learn more

Serverless SQL database from Cloudflare for archiving your Claude Code session transcripts.

  • What it stores: Every Claude Code conversation — what you asked, what was built, what files changed. Searchable development history.
  • Why it’s useful: Find “how did we build the payments page?” months later. Great for onboarding new team members or debugging past decisions.
  • Free tier: 5 GB storage, 5 million reads/day. More than enough for session transcripts.

Go to Cloudflare →

Learn more

A personal knowledge management system that gives every AI assistant — Claude, ChatGPT, Cursor — access to the same unified brain. Type a thought into Slack, and it’s instantly embedded, classified, and retrievable by any connected tool.

  • Capture: Messages in a private Slack channel are automatically embedded, classified, and stored — with people, action items, and tags extracted automatically.
  • Retrieve: An MCP server lets any AI assistant semantically search your brain and write to it using a single URL. Meaning-based, not keyword matching.
  • Multi-AI: One knowledge base shared across Claude Code, ChatGPT, Cursor, and any MCP-compatible tool.
  • No local dependencies: Runs entirely on Supabase + OpenRouter + Slack. No servers to maintain.

Based on Nate’s Newsletter

Learn more

Always-on cloud VPS for background tasks that can’t run in the browser or in serverless edge functions.

  • What runs here: Device pollers (Tesla, LG, cameras), OpenClaw (3D printer/laser cutter proxy), AI image generation, automated bug fixer, and webhook processors.
  • Options: Hostinger VPS ($5–12/mo, recommended) or Oracle Cloud (free ARM tier — always free, 4 vCPU, 24 GB RAM).
  • When you need it: Only if you have smart home devices, vehicles, maker tools, or other integrations that need continuous background polling. Most projects don’t need this.

Go to Hostinger →

Learn more

Use your own branded URL (e.g., yoursite.com) instead of username.github.io.

  • Cost: ~$10/year from any domain registrar (Cloudflare, Namecheap, Google Domains).
  • Setup: Add your domain in the Cloudflare Pages project settings. Cloudflare configures DNS and provides free HTTPS automatically.
  • When to get one: Before sharing your site publicly. You can always add a domain later without breaking anything.

Go to Cloudflare Registrar →

Learn more

Native iOS app built with Swift and SwiftUI. Full access to push notifications, camera, GPS, biometrics, and all native APIs.

  • Native performance: Built with SwiftUI for smooth 60fps animations, native navigation, and platform-idiomatic UI. Screens for lights, music, climate, cameras, vehicles, and more.
  • Shared API layer: Connects to the same Supabase backend and Home Assistant APIs as the web app.
  • Cost: Apple Developer Program ($99/yr). Requires a Mac with Xcode to build.

Go to Apple Developer →

Learn more

Native Android app built with Kotlin and Jetpack Compose. Full Material 3 design with native performance.

  • Native performance: Built with Jetpack Compose for native Android UI. Screens for lights, music, climate, cameras, vehicles, and an AI assistant.
  • Build anywhere: Android Studio runs on macOS, Windows, and Linux — no Mac required.
  • Cost: Google Play Console is a $25 one-time fee (not annual).

Go to Google Play Console →

Learn more

Add AI-powered voice calling to your app. Create phone agents that answer calls, make outbound calls, and handle conversations with natural language.

  • How it works: VAPI handles the phone infrastructure. Your Supabase edge function (vapi-webhook) processes call events and transcripts.
  • Use cases: Automated appointment reminders, AI receptionist, property inquiry hotline, emergency notification calls.
  • Config: API key and assistant settings stored in vapi_config table.

Go to VAPI →

Learn more

An AI-powered Discord bot that bridges your community server to your platform’s AI assistant. Users can chat with PAI, ask questions about the property, and trigger actions.

  • How it works: A Node.js worker (pai-discord) listens for messages and forwards them to the alpaca-pai Supabase edge function.
  • Runs on: Your background worker VPS as a systemd service.
  • Cost: Free — Discord bot accounts are free to create and run.

Go to Discord Developer Portal →

Learn more

A dedicated Mac on your local network that bridges LAN-only smart home devices to your cloud app. Runs Home Assistant OS (HAOS) as the central smart home hub.

  • What it runs: Home Assistant (HAOS — 30+ smart devices across WiZ, Govee, Tuya/SmartLife), Sonos HTTP API (music control), go2rtc (camera streams), Music Assistant, Blink camera poller, and device pollers.
  • How it connects: Tailscale VPN links the Mac to your cloud services. A reverse proxy (Hostinger or similar) routes external requests to the Mac.
  • Cost: A used Mac Mini runs ~$150 one-time. Low power draw (~10W idle).
  • When you need it: Only for smart home features (Sonos, cameras, climate control). Not needed for standard web apps.

Go to Mac Mini →

How much will you build?

This mainly affects your Claude Code plan and usage-based services.

Estimated annual cost $0

AlpacApps Architecture

67 edge functions, 11 workers, 2 native mobile apps — zero backend code

Claude Code Supabase Cloudflare Pages Alpaca Mac Hostinger
Residents / Admins / Public HTTPS CF Cloudflare Pages Static HTML/JS/CSS hosting yourdomain.com or USERNAME.github.io /spaces/ /residents/ /admin/ /auth/ API calls SB Supabase Backend-as-a-Service (database, auth, storage, edge functions) PostgreSQL Auth Storage Edge Functions CC Claude Code AI dev agent: writes code, fixes bugs, deploys, runs SQL Local or cloud (Claude Max/Pro) git push migrations Mac Alpaca Mac On-prem home server. Bridges LAN-only smart home devices Sonos go2rtc HomeA MusicA Tailscale VPN HG Hostinger VPS Reverse proxy + tunneling. Routes cloud traffic to LAN Caddy Tailscale PAI-Claw Edge Fn proxy Tailscale mesh External APIs Stripe Resend Tesla Telnyx SignWell Govee Gemini Vapi Nest Brave LG ThinQ Anova webhooks + API calls ZERO SERVER ARCHITECTURE Browser talks directly to Supabase RLS enforces security at DB level

How a request flows

01
Browser
User loads page from Cloudflare Pages
02
Supabase
JS calls Supabase API (auth + data)
03
Edge Function
Sensitive ops run server-side
04
Hostinger
Proxies to LAN via Tailscale
05
Alpaca Mac
Controls Sonos, cameras, lights

View in full setup guide →

🔄 Stay Updated

Already set up? New features get added to the template regularly. Run this prompt once a month to see what's new and adopt features you want:

Read https://alpacaplayhouse.com/infra/updates.html and help me adopt any new features that have been added since I last set up my project. Check what I already have and only offer what's new.

Or browse the updates page directly to pick and choose.