v260903.06 8:38p
AlpacApps — AI-powered platform with alpacas
Before you start

Install your coding agent, then set up the core services

Run a coding agent from an empty folder — a paid one like Claude Code or Codex, or Zed free on its trial credit. First configure screenshots, then let the agent guide account creation and bootstrap the project. It handles the terminal work; you handle the account screens and paste screenshots when asked.

20–40 minutes · Code-first setup

What you’ll do on this page

  1. Set up screenshots first — Shottr on Mac or ShareX on Windows, then paste one test capture into Code mode.
  2. Create one dedicated Gmail account for the project, used as the login for every service below.
  3. Pick and install one coding agent — a Claude or ChatGPT subscription, or Zed free on its trial credit — then open it in an empty folder.
  4. Set up Bitwarden — the recommended default credential manager — so every password and key has one safe home.
  5. Create the six core service accounts and register a domain — GitHub first, then Supabase, Cloudflare, Google Cloud, Resend, OpenRouter, and a branded domain — with the coding agent guiding you as you go.
  6. Continue setup at alpacaplayhouse.com/infra, where the agent creates, clones, and deploys the project.
  7. Fund and configure OpenRouter with Ox Alpha and DeepSeek v4 Flash for delegated coding and code review.

Nothing here is irreversible. You are only creating accounts. You do not need to create projects, API keys, tokens, or domains yet — the setup wizard does that later, once it knows your app name and domain.

Step 0 — Set up screenshots first

Before GitHub, any other account, or a terminal command, install a screenshot tool and test it in your Code-mode conversation.

Test it now: paste one screenshot into Claude Code or Codex. Your agent will use screenshots to guide you through the remaining account screens.

Step 1 — Create one Gmail account just for this project

Do this before anything else. Every account below gets created with one dedicated Gmail address that belongs to the project, not to you personally. It takes five minutes now and saves a genuinely painful migration later.

Why a separate address

  • Collaboration. Bringing in a partner, a contractor, or a co-founder means sharing one password-manager item — not handing over your personal inbox.
  • Agents. Management bots like GrokBot, or any AI agent you later wire in to watch billing, triage mail, or run reports, can be pointed at this account instead of your personal identity.
  • Handoff. If the project changes hands, the whole stack moves with the address. Nothing has to be re-registered.
  • Separation. Password resets, billing alerts, and vendor mail stay out of your personal inbox.

Do this

  1. Go to accounts.google.com/signup.
  2. Pick a name tied to the project, not to you — yourproject.ops@gmail.com or yourproject.dev@gmail.com.
  3. Save the password in your password manager immediately.
  4. Turn on 2FA and store the recovery codes next to the password.
  5. Add a recovery phone and a backup email you actually control.

Use this address for everything that follows — GitHub, Supabase, Cloudflare, Google Cloud, Resend, and OpenRouter. It also becomes the Google account behind “Sign in with Google” in your app, so Step 5’s Google Cloud work happens under this same login.

Room for helpers later. Because the project owns this inbox rather than a person, you can hand scoped access to a management agent — a GrokBot-style assistant reading billing alerts, a bot that files vendor mail, an assistant that watches for expiring keys — without ever exposing your personal account. Give any agent its own credential or app password, never the master login, and revoke it the moment it stops being useful.

This address is now the master key. Every one of those services will send password resets to it. If you lose access, you lose the stack. Recovery options and 2FA codes are not optional here — set them up before you move on, and do not let this be the one account whose password lives only in your head.

Step 2 — Pick how you pay for the agent: subscription or free plus OpenRouter

Something has to do the actual work, and there are two ways to get it. Option A is a flat monthly subscription and the smoothest road. Option B costs nothing — Zed is free, its two-week Pro trial includes $20 of model credit, and after that you can keep going on your own OpenRouter key, billed per token. Pick one and install it now; you use it for the rest of this page and the whole setup afterward.

Option A · Subscription · Recommended

Pay a monthly subscription

One app, one flat bill, no keys to wire up. The AlpacApps instructions were written and tested against these two, so the steps on the next page match what you actually see on screen.

Claude Desktop Best tested

Anthropic’s desktop app. Open Claude Code in an empty folder; it guides account setup, creates and clones the project, then does the build. Reads screenshots you paste in.

Free tier to try it; Pro $20/mo or Max $100/mo for real use.

Download Claude Desktop →

No account yet? Sign up at claude.ai.

ChatGPT Desktop (Codex)

OpenAI’s desktop app, same flow through Codex. Familiar if you already use ChatGPT, and also reads pasted screenshots.

Codex needs a paid plan — Go $8/mo is the cheapest on-ramp, Plus is $20/mo.

Download ChatGPT Desktop →

Codex CLI (optional, later): npm i -g @openai/codex — see developers.openai.com/codex.

Option B · No subscription

Zed — free, with $20 of trial credit

Zed is a free, open-source editor with an AI agent built in. Start its two-week Pro trial and you get $20 of model credit — enough to get the project standing up before you decide whether to pay anyone anything.

Zed Free trial credit

Install it, sign in, upgrade to the free trial from your account page, then set the agent’s model to Claude Sonnet 5. Open your empty folder and start. Built in Rust rather than Electron, so it also runs in a fraction of the memory of a heavier editor — the one to pick on an older or 8 GB laptop.

After the trial: Pro is $10/mo, or stay on the free plan and run it on your own OpenRouter key.

Zed setup walkthrough →

Screenshot-by-screenshot: install, the trial, the model, and the optional OpenRouter key.

Fair warning. This route is slower and more hands-on, and the pages here are worded for Claude Code and Codex — the steps still apply, you will just translate the occasional button name. Tell your agent to read AGENTS.md at the start of each session so it picks up the project rules.

Pick one path — you do not need both

Which should I pick? If $8–$20 a month is comfortable, take Option A, and within it Claude Desktop unless you already pay for ChatGPT — these instructions were written and tested against it. Take Option B if you would rather not add a subscription, or you want to find out whether this suits you before paying for anything — the trial credit is real money you did not spend. Nothing in the project is tied to one agent: the repo ships both CLAUDE.md and AGENTS.md, so you can switch later without redoing work. Whichever you pick, start it in a new, empty folder.

Step 3 — Open Code mode and paste this prompt

Open the agent you just installed — Claude Code, Codex, or Zed’s Agent Panel — in a new, empty folder and paste the prompt below. It will guide each signup and tell you exactly what to click. Claude Code and Codex also read screenshots you paste when you get stuck; on the free route, describe what you see instead.

I'm getting ready to set up an AlpacApps project. I am in Code mode in an empty folder. First ask whether I already use a password manager. Evaluate its CLI for interactive authentication and scoped, safe reads from Claude Code/Codex, explain whether it works, and use Bitwarden only if it does not. Do not use Apple Passwords/iCloud Keychain as the automation source. Then help me set up the core services in this order: GitHub, Supabase, Cloudflare, Google Cloud, Resend, and OpenRouter. GitHub goes first because Supabase, Cloudflare, and Resend all support "Continue with GitHub" — use that for each of them instead of creating separate passwords. Google Cloud uses my project Gmail instead. Everything traces back to one dedicated project Gmail: GitHub and Google Cloud are registered to it directly, and the GitHub-SSO services inherit it from there. Register and configure a branded custom domain as a core step. Help me choose a low-cost .org or .us domain, or a .com if I prefer it; show the current price and guide only any required purchase confirmation. Configure https://DOMAIN as the public placeholder and https://in.DOMAIN as the Google-authenticated intranet in Cloudflare DNS and Cloudflare Pages with HTTPS. For Google Cloud, make creating the programmatic OAuth-configuration credential the first Google Cloud configuration activity: create/select the project, grant the automation principal the OAuth Config Editor (Beta) role, create its access credential, and store it in the approved credential manager. Once it is ready, configure every API-supported OAuth setting programmatically, including the OAuth client, authorized JavaScript origins, and redirect URIs. Do not guide me through manual console configuration except to bootstrap the credential or for a setting the API does not support. Fully configure Google Sign-In through Supabase on https://in.DOMAIN, then test a real sign-in and fix it until the session and authenticated intranet flow work. For OpenRouter, create and fund an API key with a per-key credit limit; set up Ox Alpha and DeepSeek v4 Flash for delegated coding and code review. Use whichever has the lower current OpenRouter input/output cost as the default, and the other as fallback. For each one: give me the exact signup URL, tell me what to click, tell me what to write down afterward, and wait for me to say "done" before moving to the next one. I may paste screenshots — tell me if I'm on the right page. Do not create unrelated API keys, tokens, projects, or domains yet. The required exceptions are the Google OAuth-configuration automation credential and the OpenRouter API key described above. After the accounts are ready, follow https://alpacaplayhouse.com/infra/llm-setup-instructions.md to bootstrap, create, and clone the project. Reference: https://alpacaplayhouse.com/infra/prestart

Stay in Code mode. Use the same empty-folder session for the main setup. Once the accounts are ready, it installs the required tools, creates the GitHub repository from the template, clones it, and continues in that clone.

Step 4 — Set up one safe place for passwords

A programmatically usable credential manager is a core setup item. Evaluate your existing manager first; use Bitwarden when it does not meet the agent workflow checks.

Recommended default: Bitwarden

  1. Go to bitwarden.com and create a free account with the project Gmail from Step 0.
  2. Install the apps from bitwarden.com/download — desktop and phone.
  3. Install the browser extension so it generates and saves strong passwords during each signup.
  4. Create a folder named after your own project — whatever you plan to call it. Everything for this build goes in that one folder.
  5. Save one login item per service as you go.
  6. Store the Bitwarden master password somewhere offline. It cannot be reset for you.

Already use 1Password, Dashlane, or Apple Passwords? Those are fine for the account passwords — but the setup script installs the Bitwarden CLI regardless, so a free Bitwarden account is still the smoothest path for API keys and tokens.

Existing manager? Evaluate it first

  1. You may substitute an existing password manager only if it has a supported, scriptable CLI that Claude Code or Codex can use for credential retrieval.
  2. Have the agent verify CLI installation, interactive authentication, scoped read access, and a successful safe test read before adopting it.
  3. Do not use Apple Passwords/iCloud Keychain as the automation source. It is fine for personal use but is not programmatically friendly for this workflow.
  4. If the existing manager cannot meet those checks, use Bitwarden instead.

Never paste secrets into public places. No passwords, API keys, OAuth client secrets, recovery codes, or database passwords in a public doc, GitHub issue, Slack channel, screenshot, or a file committed to your repo. The password manager is the source of truth; a private tracker may contain only item names and setup status.

Want a ready-made tracker to fill in? The account setup checklist has one you can download as a file in a single click — every account below, in the order you will create them.

Step 5 — Create the core service accounts

Work top to bottom — the order matters. GitHub comes first because Supabase, Cloudflare, and Resend all offer “Continue with GitHub”. Make it first and three of the next four signups become one click instead of another password to create, store, and eventually lose. Google Cloud is the exception — it uses the project Gmail from Step 1. Every service is free or free-tier to open; OpenRouter needs a small prepaid balance to use its models. Ask your assistant whenever a screen does not look like the description.

1. GitHub

Free

Where your code lives, and where your assistant commits and pushes every change. Create this one first — Supabase and most of the services below let you sign in with GitHub, so having it already means fewer separate passwords to manage.

Do this

  1. Go to github.com/signup.
  2. Sign up with the project Gmail from Step 1.
  3. Pick a username you are happy to see in URLs.
  4. Verify your email address.
  5. Turn on two-factor authentication and save the recovery codes.

Write down

  • Username
  • Login email
  • Where the 2FA recovery codes are saved

No access token needed. Setup signs you in through the GitHub CLI browser flow, so skip Personal Access Tokens entirely.

Guard this one hardest. Once other services sign in through GitHub, whoever holds this account holds them too. 2FA on, recovery codes saved somewhere you will actually find them.

2. Supabase

Free tier

Your database, user logins, file storage, and edge functions — the backend of your app.

Do this

  1. Go to supabase.com/dashboard/sign-up.
  2. Choose Continue with GitHub and use the account you just made.
  3. Authorize Supabase when GitHub asks.
  4. Create a free organization if prompted.
  5. Stop there — do not create a project yet.

Write down

  • That you signed in via GitHub
  • Organization name
  • Password manager item name

Why wait on the project: the wizard names it, picks the region, and sets the auth URLs to match your app. If you do create one anyway, save the database password immediately — Supabase never shows it again.

Note what you signed in with. If you use “Continue with GitHub” there is no Supabase password to save — the GitHub account is the login. Write that down, so future you does not sit there trying to reset a password that never existed.

3. Cloudflare

Free core

DNS for your domain, Cloudflare Pages hosting, D1 session logging, and R2 file storage.

Do this

  1. Go to dash.cloudflare.com/sign-up.
  2. Choose Continue with GitHub, or sign up with the project Gmail if you prefer a separate password.
  3. Verify your email if asked.
  4. Tell the coding agent your preferred name and whether you prefer a cheaper .org/.us or a .com. It checks current prices and registers the choice through Cloudflare when possible; you approve the purchase if required.
  5. Do not stop at a free github.io address: configure public https://DOMAIN as a placeholder and https://in.DOMAIN as the Google-authenticated intranet, with DNS, Pages deployment, and HTTPS for both.

Write down

  • Cloudflare email
  • Account name
  • Registered domain name and purchase/registrar status

Optional head start: wait until the main setup asks for it, then create a temporary full-access custom API token: every available Account, Zone, and User permission at its highest level, across all accounts and zones. Use no expiration by default, or seven days for heightened-security projects; manually delete it after verification.

4. Google Cloud

Free

Supplies the OAuth client behind “Sign in with Google” in your app.

Do this

  1. Sign in with the project Gmail from Step 1 — it should own your app’s login settings.
  2. Sign in at console.cloud.google.com and accept the terms.
  3. Create or select a project at projectcreate and name it after your app.
  4. Make the OAuth Config Editor (Beta) automation credential first, then let the coding agent configure Google Auth programmatically and validate a real sign-in after the custom domain is live.

Write down

  • Google account email
  • Project name and Project ID, if created

Google Auth must work before setup is complete. The redirect URI is https://YOUR_PROJECT_REF.supabase.co/auth/v1/callback; after Supabase and the custom domain exist, the agent configures it, enables the Supabase Google provider, and tests a real login.

5. Resend

Free tier

Sends your app’s email — welcome messages, confirmations, notifications.

Do this

  1. Go to resend.com/signup.
  2. Choose Log in with GitHub — same account as before.
  3. Verify your email if asked.
  4. Skip domain verification for now — it needs Cloudflare DNS records the wizard will add.
  5. Skip the API key too; setup creates and validates it in place.

Write down

  • Resend login email
  • Which domain you plan to send from, if known

Step 6 — Configure OpenRouter for delegated coding and review

This is a core setup step. It requires a small prepaid balance, and gives the main coding agent two lower-cost delegated models for implementation and code review.

Model names below were checked 2 September 2026. This is the fastest-moving part of the stack. If it is now past October 2026, assume something newer, better, or cheaper exists — sort openrouter.ai/models by price and pick from the top instead of trusting the names here. The setup itself does not depend on which model you pick.

Once you are building a lot, most of the tokens go to grunt work — renaming things, filling in boilerplate, applying the same edit across twelve files. That work does not need a frontier model. The pattern here is orchestrator plus worker, and it works with any of the agents in Step 2. If you took the free route you already have the OpenRouter account and key from Step 2 — this step is where you decide which models it spends on:

Orchestrator — whichever agent you picked

  • Claude Sonnet if you chose Claude Desktop
  • GPT‑5.6 Luna if you chose ChatGPT Desktop / Codex
  • A strong OpenRouter model if you took the free route
  • Reads the codebase and decides what to change
  • Writes the spec, then reviews what comes back
  • Billed to your subscription, or to OpenRouter credit

Workers — Ox Alpha + DeepSeek v4 Flash

  • Executes the mechanical edits it was handed
  • Runs through OpenRouter, billed per token
  • Use the lower current OpenRouter price as the default
  • Never decides architecture on its own

The split matters. Judgment stays with the orchestrator; only well-specified work goes to the cheap model. If you hand DeepSeek open-ended design decisions, you will spend the savings back on cleanup.

OpenRouter

Credit card

OpenRouter is one API key that reaches many models, including Ox Alpha and DeepSeek v4 Flash. It runs on prepaid credits, so you add a payment method and buy a balance up front rather than getting a monthly bill.

DeepSeek v4 Flash gives you tokens for roughly 1–3% of what top-tier tokens cost — GPT‑5.6 Sol or Claude Opus 5. On work that is already specified, that can take a large share of the load off those models at comparable quality, and cut what you spend on them.

It is also a strong reviewer of their output. For very little extra you can have it read what the big model just wrote and hunt for bugs before anything ships — you have to ask for that explicitly, and you still confirm what it flags, but it surfaces a lot more than nothing does.

Do this

  1. Sign up at openrouter.ai and verify your email.
  2. Open Settings → Credits and add a card.
  3. Buy a small starting balance — $5 to $10 is plenty to see whether you like the workflow.
  4. Create a key at Settings → Keys and set a credit limit on the key itself, so a runaway loop cannot drain the balance.
  5. Save the key in your password manager the moment it appears — OpenRouter shows it once.
  6. Find the current Ox Alpha and DeepSeek v4 Flash entries on openrouter.ai/models, record both exact model slugs and prices, then make the lower-cost one the default.

Write down

  • OpenRouter login email
  • API key — password manager only, never in the repo
  • Both model slugs, their checked prices, and the selected default
  • The per-key credit limit you set

This one actually charges you. Turn off auto-recharge until you know your usage, keep a per-key credit limit on, and check Activity after your first heavy session. The key goes in .env as OPENROUTER_API_KEY — and .env is never committed.

Confirm both models before you rely on them. Model catalogues, slugs, and prices change. Pull current values from the models page rather than trusting a value written here, and tell your assistant which is the lower-cost default.

After OpenRouter is ready, paste this into your coding agent:

OpenRouter is configured. Make both Ox Alpha and DeepSeek v4 Flash available for delegated coding and code-review tasks. Look up their current OpenRouter model slugs and current input/output prices. Select whichever is lower cost as the default delegated coding and code-review model, with the other as its fallback. You remain the main coding agent: delegate eligible implementation and review work to the selected lower-cost model, then review its output, run validation, and retain all architecture, security, auth, payment, and release decisions yourself.

Next step is on the setup page. Once the account and key exist, the full wiring instructions — the worker script, the routing rule for CLAUDE.md/AGENTS.md, and the Codex provider profile — live at the OpenRouter step on the setup page.

You’re ready

You are done with pre-start when an approved credential manager plus all six core services are registered to your project Gmail, you can sign in to each one, and you know where the saved credentials live.

What to tell your assistant next: “I installed my coding agent, evaluated my credential manager, created my GitHub, Supabase, Cloudflare, Google Cloud, Resend, and OpenRouter accounts, and stored credentials in the approved manager. Google OAuth configuration automation is ready. Start the AlpacApps Infra setup.”