Owner credential run-sheet — the accounts only you can open
Status: Active · Last reviewed: 2026-09-17 · Audience: the owner, one sitting per section, browser and phone in hand. Everything else in the External Blockers Register is routed to Claude, counsel or a vendor; this page is the part that needs your identity, your card, or your admin seat.
Each row says what to open, what to copy, and where to paste it. Once a value is in the place named in the last column, Claude takes it from there (deploy, build, smoke, evidence) and closes the register entry. Never paste a secret into chat, a commit or the QA board — the "where it goes" column is always a secret store.
Two secret stores, two commands
- App-side public config (
EXPO_PUBLIC_*):apps/mobile/.envlocally, and the EAS environment for builds/OTAs (eas env:create --environment preview --name NAME --value VALUEfromapps/mobile, then the same forproductionwhen we go live). - Server-side secrets (edge functions):
npx supabase secrets set NAME=VALUEfrom the repo root (hosted project only — never needed for local).
A. Kakao — login, sharing, support channel (EXT-11, EXT-14, EXT-15)
| # | Open | Do | Copy | Where it goes |
|---|---|---|---|---|
| A1 | developers.kakao.com → 내 애플리케이션 → 애플리케이션 추가하기 | Name "투마", company "TwoMore"; upload the 1024px icon from apps/mobile/assets/icon.png | 앱 키 → 네이티브 앱 키 and REST API 키 | native key → EAS env EXPO_PUBLIC_KAKAO_APP_KEY (preview); REST key → Supabase Auth Kakao provider |
| A2 | same app → 플랫폼 | Android: package com.ivorybridge.twomore + the release key hash Claude prints from the EAS keystore (ask); iOS: bundle com.ivorybridge.twomore once C1 exists | — | — |
| A3 | same app → 카카오 로그인 → 활성화 ON → Redirect URI | Add https://<supabase-project-ref>.supabase.co/auth/v1/callback (Claude gives the exact URL) | — | — |
| A4 | same app → 카카오 로그인 → 동의항목 | 닉네임, 프로필 사진: 필수; 카카오계정(이메일): 필수 (needs 비즈 앱 전환 — see A5) | — | — |
| A5 | same app → 앱 설정 → 비즈니스 → 비즈 앱 전환 | Requires 사업자등록번호 — do this once the business registration exists; until then email consent stays 선택 | — | — |
| A6 | same app → 제품 설정 → 보안 → Client Secret | 생성 → 활성화 ON | Client Secret | Supabase Dashboard → Authentication → Providers → Kakao (Client ID = REST API 키, Secret = this) |
| A7 | same app → 카카오톡 공유 → 메시지 템플릿 | Create six custom templates from packages/app/src/config/kakao-share-templates.json (Claude drafts each field for you) | six 템플릿 IDs | EAS env TWOMORE_KAKAO_TEMPLATE_* — the six names are printed by yarn check:r1-kakao-share:credentials |
| A8 | business.kakao.com → 카카오톡 채널 → 새 채널 만들기 | Name "투마 고객센터"; 공개 ON; 검색 허용 ON | the pf.kakao.com/_xxxx URL | EAS env + .env EXPO_PUBLIC_SUPPORT_KAKAO_CHANNEL_URL — the 문의하기 screen adds the row itself |
After A1–A6 Claude flips the Supabase Kakao provider on, ships a preview OTA, and you tap 카카오로 시작하기 once on the phone. After A7 Claude runs the credentials gate and a preview build (templates need the native key at build time). After A8 no build is needed — an OTA.
B. PortOne — real card payments (EXT-12)
| # | Open | Do | Copy | Where it goes |
|---|---|---|---|---|
| B1 | admin.portone.io → 회원가입 → 사업자 정보 | Needs 사업자등록번호 and a settlement bank account | — | — |
| B2 | 결제 연동 → 채널 관리 → 채널 추가 | PG: 토스페이먼츠 (or KG이니시스); start with the 테스트 channel | Store ID, Channel Key | tell Claude — public values; they go into the PortOne adapter config when it is built (guide §3) |
| B3 | 결제 연동 → API Keys → V2 API Secret 발급 | Generate | V2 API Secret | npx supabase secrets set PORTONE_V2_API_SECRET=… |
| B4 | 결제 연동 → 웹훅 → 웹훅 추가 | URL https://<project-ref>.supabase.co/functions/v1/portone-webhook (Claude gives it); version 2025-01-01 | Webhook Secret | npx supabase secrets set PORTONE_WEBHOOK_SECRET=… |
| B5 | (after test smoke) 채널 관리 → 실연동 전환 | Only after the test-channel checklist in portone-payments.md is green | new Store ID / Channel Key | same as B2, production only |
Claude deploys verify-portone-payment and portone-webhook (both answer 503 not_configured until B3/B4 are set), builds the native adapter, runs the TEST-channel checklist with a 100원 hold, and records the evidence.
C. Apple — iOS builds and Sign in with Apple (EXT-4, EXT-13)
| # | Open | Do | Copy | Where it goes |
|---|---|---|---|---|
| C1 | developer.apple.com → enroll (organization needs a D-U-N-S number; individual is faster) | Pay the annual fee | Team ID (Membership page) | tell Claude — it goes into apps/mobile/app.config.js (public) |
| C2 | App Store Connect → Users and Access → Integrations → App Store Connect API → Generate key | Role Admin | Issuer ID, Key ID, the downloaded .p8 | eas credentials prompt on Claude's machine (ASC key), never the repo |
| C3 | Certificates, Identifiers & Profiles → Identifiers → App IDs | Bundle com.ivorybridge.twomore; enable Sign in with Apple, Push Notifications, Associated Domains | — | — |
| C4 | same → Keys → new key with Sign in with Apple | Download | Key ID + .p8 | Supabase Dashboard → Authentication → Providers → Apple |
| C5 | Xcode / eas build -p ios --profile preview on Claude's machine | The first run asks for your Apple ID login interactively — sit with Claude for that one build | — | — |
D. GitHub — billing, protection, CI secrets (EXT-5, EXT-6)
| # | Open | Do | Copy | Where it goes |
|---|---|---|---|---|
| D1 | github.com → org ivorybridge-2025 → Settings → Billing → Actions | Add a payment method or a spending limit so Actions minutes run (they are paused today) | — | — |
| D2 | repo → Settings → Branches → Add rule for main | Require status checks check, pgtap, drift, knip (the four jobs in .github/workflows/ci.yml); require branches up to date; no force-push | — | — |
| D3 | supabase.com → Account → Access Tokens → Generate | Name "twomore-ci" | token | repo → Settings → Secrets → Actions → SUPABASE_ACCESS_TOKEN |
D1 is the one that unblocks everything else here — CI has been running only on the pre-push hook.
E. Registrations that gate public launch (EXT-1, EXT-3)
| # | Open | Do | Copy | Where it goes |
|---|---|---|---|---|
| E1 | — | Decide who the 개인정보 보호책임자 is (you, until a company exists) and a real phone/email for them | name · phone · email | packages/app/src/config/legal/documents/privacy.ko.ts §11 and the placeholders in packages/features/profile/src/privacy-screen.tsx (Claude edits; public — printed in the policy) |
| E2 | lbsc.kr → 위치기반서비스사업자 신고 | Needs 사업자등록번호; file before the GPS check-in feature is public | 신고번호 | the 위치기반서비스 이용약관 document under packages/app/src/config/legal/documents/ (public) |
When a row is done
Reply on the QA board with the row id (for example "A8 done") — Claude picks it up from there, ships, verifies on the hosted bed, and moves the register entry. Rows that need a native build (A7, C5) take longer than an OTA; everything else is minutes.