# Cloudflare Pages deployment

This project uses `_worker.js` to provide the same-origin `/api/wallet-nfts` endpoint while continuing to serve every static website file through the Pages `ASSETS` binding.

## Required secret

1. Create an OpenSea API key.
2. In Cloudflare, open **Workers & Pages** and select the Pages project.
3. Open **Settings → Variables and Secrets → Add**.
4. Set the name to `OPENSEA_API_KEY`.
5. Paste the API key as the value and select **Encrypt**.
6. Save the secret, then create a new production deployment.

Never add the API key to `instance-config.js`, `_worker.js`, any HTML file, a source archive, or a screenshot.

## Upload

Upload the complete `eternalbes-site` directory, including `_worker.js`. Cloudflare Pages dashboard drag-and-drop supports the advanced-mode `_worker.js` file. Do not rename it and do not place it inside another folder.

After deployment, open `/api/wallet-nfts?owner=0x...` with a valid wallet address. A configured deployment returns JSON containing `tokens`. A deployment without the encrypted secret returns `INDEXER_NOT_CONFIGURED` and the website keeps manual NFT entry available as a fallback.

## Hidden Robinhood Launchpad test route

The Robinhood testnet Launchpad is isolated under `/launchpad/`. The homepage and existing navigation do not link to it. The route sends `noindex`, `nofollow`, and `noarchive` directives, but an unlinked URL is not authentication. Use Cloudflare Access when the test must be private.

Current staging targets:

- Pages project: `eternalbeings`
- Website: `https://www.eternalbeings.space`
- Hidden Launchpad: `https://www.eternalbeings.space/launchpad/`

The static Launchpad calls `/launchpad/api/*`. `_worker.js` handles those requests directly in Cloudflare and leaves the existing website and `/api/wallet-nfts` endpoint unchanged. No Tunnel or always-on Mac is required.

Add these encrypted secrets to the Pages project:

- `FILEBASE_ACCESS_KEY`
- `FILEBASE_SECRET_KEY`
- `FILEBASE_BUCKET`: `in-worlds-launchpad`
- `LAUNCHPAD_CHALLENGE_SECRET`: a new random value of at least 32 bytes

Optional variables:

- `FILEBASE_S3_ENDPOINT`: `https://s3.filebase.com`
- `ROBINHOOD_RPC_URL`: `https://rpc.mainnet.chain.robinhood.com`
- `OPENSEA_API_KEY`: required only when OpenSea indexes NFTs for the selected network
- `OPENSEA_CHAIN`: `robinhood`
- `IPFS_READ_GATEWAY`: optional server-side IPFS read gateway; defaults to `https://w3s.link/ipfs/`

Never add any of these secrets to HTML, JavaScript, screenshots, or files inside this website directory.

For a test deployment:

1. Add the encrypted Cloudflare secrets above.
2. Redeploy the complete `eternalbes-site` directory with `_worker.js` and `launchpad/worker-api.js` included.
3. Open `/launchpad/` directly. Do not add a homepage link until production release.

The Launchpad configuration uses the audited Robinhood mainnet deployment. Complete the release tests before adding the homepage Launchpad link.
