Skip to main content
OpenDot includes a root render.yaml Blueprint for a Render preview deployment. It creates:
  • opendot-web: static Vite console.
  • opendot-api: Docker web service for the platform API.
  • opendot-runtime: Docker web service for realtime voice sessions.
The API service runs database migrations as its Render pre-deploy command.

​
Database

Use Supabase Postgres for the first Render deployment:
OpenDot still owns product data in app_users, user preferences, SDK API keys, agents, pipelines, devices, device activation requests, device credentials, runtime session tokens, device state, and deployments. Supabase Auth owns sign-in without making auth.users the product data table.

​
Required Render values

The Blueprint marks secrets and deployment-specific URLs as sync: false. Fill them in the Render dashboard during Blueprint creation:
Leave SUPABASE_JWT_SECRET empty unless the Supabase project still uses legacy HS256 JWT signing. OPENAI_BASE_URL applies to the Sandwich LLM stage only. Speech-to-speech Browser Test and Speech-to-speech Dot sessions use the runtime’s OPENAI_API_KEY against OpenAI’s Realtime API.

​
Auth posture

The Render Blueprint uses:
That makes Supabase the Render identity provider. For email/password signup without email verification, disable email confirmations in the Supabase Auth settings for the preview project. The forgot-password, Google, and GitHub controls are present in the UI but are not wired yet.

​
Runtime exposure

The runtime verifies browser voice-session tokens, realtime browser-session tokens, and device credentials with the platform API. Sandwich Browser Test uses /voice, Sandwich Dot devices use /ws, Speech-to-speech Browser Test uses /realtime/client-secret before the browser connects to OpenAI Realtime with an ephemeral client secret, and Speech-to-speech Dot devices use the runtime /ws Realtime bridge. Use the same OPENDOT_RUNTIME_INTERNAL_SECRET on opendot-api and opendot-runtime. For public previews, keep provider-key quotas tight and point OPENDOT_RUNTIME_PUBLIC_HTTP_URL / OPENDOT_RUNTIME_PUBLIC_WS_URL at the deployed runtime URL.