Agent test account

Cloud agents (Cursor, Codex) need a confirmed Supabase user to exercise signup, login, saving walls, and share links on production. Guest mode works without this; account flows do not.

Recommended setup

1. Pick a dedicated inbox you control (or a plus-address alias), for example you+digitalwalls-agent@gmail.com. 2. Choose a strong password (12+ characters). Use the same value everywhere you store it. 3. In Supabase → Project Settings → API, copy the service role key (server-only; never commit it or expose it in the browser). 4. Run the provisioning script once:

export SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
export SUPABASE_SERVICE_ROLE_KEY='your-service-role-key'
export TEST_ACCOUNT_EMAIL='you+digitalwalls-agent@gmail.com'
export TEST_ACCOUNT_PASSWORD='Your-long-test-password'
node scripts/create-test-account.mjs

The script creates the user with email_confirm: true or resets the password if the email already exists. No confirmation email is required for login after that.

5. Add secrets to your Cloud Agent environment (same values, without the service role key unless you want agents to refresh the account):

Optional (only to re-run provisioning from an agent): SUPABASE_SERVICE_ROLE_KEY.

6. In Supabase Auth → URL Configuration, ensure redirects exist for your origin (/?auth=confirm and /?auth=recovery). See SUPABASE_AUTH.md.

How agents should sign in

• Open APP_ORIGIN (production: https://digitalwalls.vercel.app).
• Use Sign in with TEST_ACCOUNT_EMAIL and TEST_ACCOUNT_PASSWORD.
• Create or open a wall, edit, and confirm Saved — same as a normal user.

For local development without Supabase, isolated tests use ALLOW_LOCAL_AUTH_FOR_TESTS=1; that path is not available on Vercel.

Security notes

• Treat the test account like a shared QA login: no real personal data, rotate the password if it leaks.
• The service role key bypasses Row Level Security in Supabase; keep it in secret stores only.
• Do not commit credentials or the service role key to the repository.