Set up Evie's shop

1. Know where to save settings

Open Evies World → Settings → Environment Variables. Add or edit the names below, selecting Production. Choose Secret for private keys and tokens. The website is a Vercel production deployment even while its shop is in preview or test mode.

These starting values are already saved:

SHOP_MODE=preview
SHOP_ENABLE_LIVE=false
SHOP_SITE_URL=https://eviesworld.xyz

After each batch of settings, open Deployments, choose the latest Production deployment, open its menu, and choose Redeploy to Production. Use the latest project settings if prompted. Wait for Ready, then reload this website. Environment changes need a new deployment.

Keep SHOP_SITE_URL on the address above and use that address for setup and checkout. If you later change the main domain, also update Firebase's allowed domain and both payment webhook URLs.

Vercel environment documentation ↗

2. Connect Firebase and approve your parent account

1. Open the Firebase Console and create a separate shop test project. You will use a different Firebase project for live selling.
2. Under Build → Firestore Database, create the default database using Standard / Native mode and production rules. In its Rules tab, paste and publish the rules below.
3. Under Build → Authentication → Sign-in method, enable Google and select a support email. Under Authentication → Settings → Authorized domains, add eviesworld.xyz and www.eviesworld.xyz.
4. Open Project settings → General, register a web app with the </> button, and find its Firebase configuration. Save it in Vercel as FIREBASE_WEB_CONFIG: a JSON object with quoted keys and values, without the const firebaseConfig = wrapper. Use the example below as a format guide.
5. Open Project settings → Service accounts → Firebase Admin SDK → Generate new private key. Open the downloaded JSON privately. Copy its project_id to FIREBASE_PROJECT_ID, client_email to FIREBASE_CLIENT_EMAIL, and private_key to FIREBASE_PRIVATE_KEY in Vercel. Paste only the field value, without surrounding JSON quotes; the private key accepts multiline text or literal \n separators. The web app and service account must belong to the same project.
6. Keep SHOP_MODE=preview and SHOP_ENABLE_LIVE=false, and redeploy with the Firebase settings above.
7. Visit the parent dashboard and click Sign in with Google. Your first attempt creates your Firebase user and shows your parent UID on screen. You can also find it under Firebase Authentication → Users. The dashboard stays locked until the next step.
8. Add SHOP_ADMIN_UIDS in Vercel with that UID. Use comma-separated UIDs if approving another parent. Set SHOP_MODE=test, keep SHOP_ENABLE_LIVE=false, and redeploy again. Reload the dashboard and sign in with the same Google account. You can manage the catalog before connecting payments.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{collection}/{document} {
      allow read, write: if false;
    }
    match /users/{uid} {
      allow read, write: if request.auth != null && request.auth.uid == uid;
      match /{rest=**} {
        allow read, write: if request.auth != null && request.auth.uid == uid;
      }
    }
  }
}

{
  "apiKey": "COPY_YOUR_WEB_APP_API_KEY",
  "authDomain": "YOUR_PROJECT_ID.firebaseapp.com",
  "projectId": "YOUR_PROJECT_ID",
  "storageBucket": "COPY_YOUR_WEB_APP_STORAGE_BUCKET",
  "messagingSenderId": "COPY_YOUR_SENDER_ID",
  "appId": "COPY_YOUR_WEB_APP_ID"
}

The service-account JSON is private. Upload photographs through the creation form only; keep account keys in Vercel's environment settings. Shop records use the server API, so no Firestore collections need to be created by hand.

Firebase Admin setup ↗ · Google sign-in setup ↗

3. Add real creations and YouTube videos

1. In the Vercel Storage dashboard, create a public Blob store for creation photographs. Connect it to Evies World for Production. Its read/write token must be saved as BLOB_READ_WRITE_TOKEN. Redeploy.
2. In the dashboard's Creations tab, add a title, permanent link slug, description, USD price with shipping included, material, dimensions, and care instructions. Upload up to eight JPEG, PNG, or WebP photographs, each under 3 MB. Add descriptions of the photos. Save as Draft while preparing it.
3. Each listing represents one exact painted piece. When that piece is ready, change its status to Available and save. It appears on the public shop. In test mode, any connected payment method uses test payments.
4. Upload your making or painting video to YouTube. In the dashboard's Videos tab, paste the YouTube link or video ID, add a title and description, select its related creations, check Publish on the Videos page, and save. Then edit the creation and select the video in its Linked videos field.

You can finish the catalog and videos before connecting payment providers. The illustrated sample shelf disappears when the Firebase test shop is connected; your new catalog starts empty.

Vercel Blob documentation ↗

4. Connect Stripe test payments

1. Open the Stripe Dashboard in a Sandbox / test environment. Copy its secret API key into STRIPE_SECRET_KEY in Vercel. It must start with sk_test_.
2. Open Tax in Stripe and configure the seller's business origin, the registrations that apply, and a product tax code for the physical goods. You can set that code as SHOP_PRODUCT_TAX_CODE or use Stripe's account default. After completing tax setup, set SHOP_TAX_CONFIGURED=true. Both Stripe and PayPal use Stripe Tax.
3. Under Workbench → Webhooks, add an event destination for Your account using the webhook URL and event list below. Choose webhook delivery with snapshot events. Save its signing secret as STRIPE_WEBHOOK_SECRET in Vercel, then redeploy.

https://eviesworld.xyz/api/shop/?action=stripe-webhook

checkout.session.completed
checkout.session.async_payment_succeeded
checkout.session.async_payment_failed
checkout.session.expired
refund.created
refund.updated

Cards and eligible Apple Pay / Google Pay wallets use Stripe's hosted checkout. Test a successful payment, a declined payment, and a refund. Confirm the paid order appears in the parent dashboard and the exact piece becomes sold. A refund leaves it sold until you explicitly relist it.

Stripe webhook setup ↗ · Stripe Tax setup ↗

5. Connect PayPal Sandbox

1. Open the PayPal Developer Dashboard. Under Apps & Credentials, select Sandbox and create an app. Save its credentials as PAYPAL_CLIENT_ID and PAYPAL_CLIENT_SECRET in Vercel, and set PAYPAL_ENV=sandbox.
2. In that app's webhook settings, add the URL below and select the listed capture events. Save the webhook's ID as PAYPAL_WEBHOOK_ID in Vercel. Redeploy.
3. Use a Sandbox buyer account to complete checkout. Verify the order in both PayPal and the parent dashboard. Test a refund from the parent dashboard. PayPal checkout also requires the configured Stripe test key and Stripe Tax from step 4.

https://eviesworld.xyz/api/shop/?action=paypal-webhook

PAYMENT.CAPTURE.COMPLETED
PAYMENT.CAPTURE.PENDING
PAYMENT.CAPTURE.DENIED
PAYMENT.CAPTURE.REFUNDED

Keep the slash before ?action= in both webhook URLs so payment providers reach the API directly.

PayPal webhook documentation ↗

6. Connect receipts and seller notifications

1. Open Resend → Domains, add a sending domain or subdomain, and add its displayed DNS records wherever you manage that domain. Wait for Resend to verify it.
2. Create a sending API key in Resend. Add RESEND_API_KEY in Vercel. Set SHOP_EMAIL_FROM to a sender on the verified domain, for example Evies World <orders@YOUR_VERIFIED_DOMAIN>.
3. Set SHOP_SELLER_EMAIL to the parent's inbox for new-order notifications and SHOP_SUPPORT_EMAIL to an inbox you monitor for customer questions. Redeploy.
4. Complete a test order, enter tracking in the dashboard's Orders tab, then issue a refund there. Check the customer and seller inboxes for receipts, shipping updates, and refund notices. Test emails have a [TEST] subject prefix. Unsent emails appear under Pending jobs.

Resend domain verification ↗

7. Enable private backups and automatic checks

1. Create a second Vercel Blob store with private access. Save that store's read/write token in Production as SHOP_BACKUP_BLOB_TOKEN. Keep the public photo store's BLOB_READ_WRITE_TOKEN pointing to the photo store. If connecting the second store offers an environment-variable prefix, choose a different prefix, then copy its token to SHOP_BACKUP_BLOB_TOKEN.
2. Generate a long random secret using your password manager and save it as CRON_SECRET in Vercel. Redeploy.
3. In Vercel's project Settings → Cron Jobs, confirm /api/shop-maintenance/ is scheduled every five minutes. It checks checkout holds, payment outcomes, refunds, and pending emails; it also writes a daily compressed backup and retains seven days.
4. After a maintenance run, inspect the private store for a daily backup and check the dashboard's Pending jobs. The dashboard's Retry pending jobs button runs checks immediately; scheduled maintenance creates the backups.

The production deployment runs cron even when SHOP_MODE is test. Backups contain private order and customer information. Database restore is an administrator recovery operation that uses the included restore script.

Vercel cron documentation ↗

If a step doesn't work

• Sign-in button is disabled: check FIREBASE_WEB_CONFIG and redeploy. After signing in and saving your UID, finish the other Firebase variables and set SHOP_MODE to test for the test catalog.
• Google popup fails: check the Google provider and authorized domains in the same Firebase project as FIREBASE_WEB_CONFIG.
• Sign-in succeeds but access is denied: copy that user's UID from the matching Firebase project into SHOP_ADMIN_UIDS, redeploy, and reload.
• Shop is empty: save a real-photo creation as Available. Drafts stay private.
• A payment button is missing: check that provider's variables and Stripe Tax. The dashboard lists services that still need configuration.
• API returns a configuration error after switching modes: test and live must use different Firebase projects and matching provider keys. Check Vercel runtime logs.