Building with payDeployment
Overview
Choose the right hosted deployment path for a pay gateway.
pay server start is a long-running HTTP gateway. In production, run it as a containerized service: the container loads one provider spec, verifies HTTP 402 payments, and forwards paid requests to your upstream API.
Start with Vercel when its Function limits fit your API. Use Cloud Run with Terraform when you need native GCP service accounts, Secret Manager, and Cloud KMS/HSM signer isolation.
Options
| Option | Use when | Tradeoffs |
|---|---|---|
| Deploy to Vercel | You want the fastest hosted container deploy. | Container images are beta, custom images inherit Function limits, and env-backed signers live in Vercel secrets plus process memory. |
| Deploy to Cloud Run with Terraform | You want production GCP identity, Secret Manager, KMS/HSM signing, and infrastructure review. | More setup, but the security model is cleaner for a fee-payer signer. |
Shared rules
- Use the published
latestpayimage until versioned container tags are available. - Keep
provider.yml, OpenAPI files, and infrastructure reviewed together. - Store
PAY_RPC_URL,PAY_PAYMENT_RECIPIENT,PAY_MPP_CHALLENGE_SECRET, upstream API keys, and signer material in platform secrets. - Set
PAY_MPP_CHALLENGE_SECRETonce per environment. Rotating it invalidates outstanding 402 challenges and can make paid retries fail. - Probe
GET /__402/healthand test a paid route withpay curlafter each deploy.