Connect your accounts

Launchpad builds everything in accounts you own, so it needs a key for each provider your app actually uses, and none for the rest.

How to connect one

In the console, go to Connections, or use the Before you deploy list on the configure screen, which shows only the accounts the app in front of you needs.

• Vercel and Supabase have a Connect button. You approve access in their window and come back; nothing to copy.
• Everything else takes a key you paste once. Each row links to the page where that key is made.

Keys are encrypted before they're stored and never shown again. To replace one, paste a new value over it. See How your secrets are kept.

What each account is for

Account	Needed when	What to paste
Vercel	Always, for hosting the web app	VERCEL_TOKEN, plus VERCEL_TEAM_ID for a team
Neon	The database is on Neon (the default)	NEON_API_KEY, plus NEON_ORG_ID for a personal key
Supabase	The database, Supabase sign-in or Supabase Storage	SUPABASE_ACCESS_TOKEN, SUPABASE_ORG_ID
Upstash	The app uses Redis	UPSTASH_EMAIL, UPSTASH_API_KEY
Resend	The app sends email	RESEND_API_KEY (full access, so it can create domains and send-only keys)
Cloudflare	Bot protection, R2 storage, Pages hosting or DNS	CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
Render	The app has a background worker, cron job or separate API	RENDER_API_KEY, RENDER_OWNER_ID
Stripe	Payments	STRIPE_SECRET_KEY, STRIPE_PUBLISHABLE_KEY

Use test keys (sk_test_…) while you build.

The Cloudflare token

Cloudflare tokens carry only the permissions you tick, and the right set depends on what your app uses. The console's button opens Cloudflare's Create token page with them already ticked, so you press Create and paste the result.

What your app uses	Permission the token needs
Bot protection (Turnstile)	Account → Account Settings → Edit
File storage on R2	Account → Workers R2 Storage → Edit, and Account → Account API Tokens → Edit
Hosting on Cloudflare Pages	Account → Cloudflare Pages → Edit
DNS records added for you	Zone → DNS → Edit, and Zone → Zone → Read

Two things catch people out:

• R2 must be turned on for the account before a deploy can create buckets. Open R2 Object Storage once in the Cloudflare dashboard; the free tier is enough, but Cloudflare asks for a payment method.
• The account id is on your Cloudflare account's home page. A zone id, which looks similar, won't work.

Giving as little access as possible

• Connect only the providers your app's services need. The plan lists them before you deploy.
• Prefer the Connect buttons: they ask the provider for scoped access rather than a token that can do anything.
• On Vercel, a team token can be limited to the projects Launchpad manages.
• Remove a key any time in Connections. Deploys that needed it stop working; nothing already running is affected.

Next

• Choose your app's services explains what each service creates.
• Providers and credentials is the full table, including the variables your app receives.