> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axon402.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment

> Deploy AXON to production

> [!NOTE]
>
> Use [Quickstart](https://docs.axon402.com/docs/getting-started/quickstart.md) for the hosted product path. This page is for self-hosted AXON operators deploying their own Decision API and dashboard.

## Database (Supabase)

1. Ensure **Row Level Security (RLS)** is enabled on all tables
2. Add your production domain under **Authentication > URL Configuration**
3. If you use the kill switch, ensure you have a manual SQL unfreeze path

## Platform (Frontend)

The frontend is a Vite + React SPA.

### Build

```bash theme={null}
cd platform
cp .env.example .env.local
npm run build
```

### Deploy to Vercel / Netlify

1. Connect your repository
2. Set `Root Directory` to `platform`
3. Add environment variables:
   * `VITE_SUPABASE_URL`
   * `VITE_SUPABASE_ANON_KEY`
   * `VITE_AXON_DECISION_API_URL`

## Decision Daemon (Backend)

The backend runtime is the Decision daemon. It serves `/health`, `/ready`, and `/v1/*` on port `3030`.

### Configuration

```bash theme={null}
cd axon-402-mcp
```

Local development reads `axon-402-mcp/.env` if present. Start from the checked-in example:

```bash theme={null}
cp axon-402-mcp/.env.example axon-402-mcp/.env
```

Hosted deployments should provide the same keys via the host environment or a secret manager.

### Minimum Live Configuration

```env theme={null}
SUPABASE_URL=https://<project>.supabase.co
SUPABASE_SERVICE_KEY=<service-role-key>
BASE_RPC_URL=https://<base-rpc>
AXON_API_KEY_HASH_PEPPER=<32+ char secret>
AGENT_WALLET_ID=<wallet-uuid-or-bootstrap-placeholder>
AXON_MCP_PUBLIC_URL=https://api.axon402.com/v1/mcp
AXON_SECRETS_KEY=<base64-32-byte-key>
AXON_NETWORK_MODE=mainnet
AXON_PLATFORM_AUTH_ENABLED=true
AXON_PLATFORM_ALLOWED_ORIGINS=https://axon402.com
AXON_PLATFORM_URL=https://axon402.com/
```

Add `MASTER_MNEMONIC` when `AXON_SIGNING_MODE=full`. If you need static operator routes such as `/v1/metrics`, `/v1/webhooks/dispatch`, or `/v1/operator/mcp`, also set `AXON_DECISION_API_KEY`.

### Start

```bash theme={null}
cd axon-402-mcp
npm run build
npm run start:decision-api
```

### Cloud Run

Use the supported deploy script:

```bash theme={null}
GCP_PROJECT_ID=<your-project> ./scripts/deploy-cloud-run.sh
```

The script intentionally uses `gcloud run deploy --update-env-vars`, not `--set-env-vars`, so out-of-band tuning and opt-in worker flags survive deploys. For a fresh service, seed required live env vars such as `AXON_MCP_PUBLIC_URL` before first traffic.

### Health Gate

```bash theme={null}
curl http://127.0.0.1:3030/health
curl http://127.0.0.1:3030/ready
```

Only proceed if `/ready` returns `200`, `checks.auth.ok` is `true`, `checks.supabase.ok` is `true`, and `config_issues` is empty or warn-only.

For a fresh deployment, expect `/ready` to stay non-ready until the default wallet and mandate exist. The supported path is to bootstrap first, then re-check readiness.

### Docker

```bash theme={null}
docker build -t axon-decision-api axon-402-mcp
docker run --rm -p 3030:3030 --env-file axon-402-mcp/.env axon-decision-api
```

## End-to-End Test Plan

1. Create the first operator account in Supabase Auth, or sign in with your configured browser auth flow
2. Complete the onboarding wizard at `/onboarding`
3. Verify the vault is created in the Vault page
4. Verify the first agent pocket exists in Workforce
5. Mint a runtime key or register AXON in your MCP/OpenClaw client
6. Run one low-risk governed fetch
7. Run one approval-required flow
8. Confirm `axon-op auth whoami` works with an org-wide operator key

## Security Checklist

* Verify `user_organizations` isolation with a second test account
* Ensure `SUPABASE_SERVICE_KEY` is never used in the frontend
* Verify the daemon refuses to start when both `AXON_DECISION_API_KEY` and `AXON_PLATFORM_AUTH_ENABLED=true` are absent
* Verify `/ready` is green before exposing
* Treat server-held mnemonic custody as a high-trust deployment: use a secret manager, isolate the host, and start with low treasury balances until you have exercised approval, freeze, and recovery paths


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.