Environment Bindings Reference

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Binding checklist

1. Action 1 - Confirm binding exists in Env: Source of truth is partners-api/src/index.ts.
2. Action 2 - Confirm local value exists: Development cannot rely on production-only secrets.
3. Action 3 - Confirm deployment value exists: Wrangler and Cloudflare environments must have the binding.
4. Action 4 - Confirm routes using it are documented: Link each binding to route families and workflows.

Major binding groups

Group	Examples	Risk
Supabase	SUPABASE_URL, keys, JWT secret	database auth and service access
Origins	ALLOWED_ORIGIN, dashboard, site, rego URLs	credentialed CORS and links
CMS/media	Sanity and CMS bindings	uploads and content management
Mail/hooks	GAS mail and Auth hook secrets	outbound email and account lifecycle
Social	Discord, Telegram, social-link state	identity linking and role sync
Finance/wallet	Google Wallet bindings	passes and attendee entitlements
Internal	cron, test-control, suppression	automation and certification safety
LAN releases	GitHub owner, repo, token	release download proxy