# Overview

> Choose the right hosted deployment path for a pay gateway.

`pay server start` is a long-running HTTP gateway. In production, run it as a containerized service: the container loads one provider spec, verifies HTTP 402 payments, and forwards paid requests to your upstream API.

Start with Vercel when its Function limits fit your API. Use Cloud Run with Terraform when you need native GCP service accounts, Secret Manager, and Cloud KMS/HSM signer isolation.

## Options

| Option                                                                             | Use when                                                                                      | Tradeoffs                                                                                                                            |
| ---------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| [Deploy to Vercel](/docs/building-with-pay/deployment/vercel)                      | You want the fastest hosted container deploy.                                                 | Container images are beta, custom images inherit Function limits, and env-backed signers live in Vercel secrets plus process memory. |
| [Deploy to Cloud Run with Terraform](/docs/building-with-pay/deployment/cloud-run) | You want production GCP identity, Secret Manager, KMS/HSM signing, and infrastructure review. | More setup, but the security model is cleaner for a fee-payer signer.                                                                |

## Shared rules

- Use the published `latest` `pay` image until versioned container tags are available.
- Keep `provider.yml`, OpenAPI files, and infrastructure reviewed together.
- Store `PAY_RPC_URL`, `PAY_PAYMENT_RECIPIENT`, `PAY_MPP_CHALLENGE_SECRET`, upstream API keys, and signer material in platform secrets.
- Set `PAY_MPP_CHALLENGE_SECRET` once per environment. Rotating it invalidates outstanding 402 challenges and can make paid retries fail.
- Probe `GET /__402/health` and test a paid route with `pay curl` after each deploy.

## Next

- [Deploy to Vercel](/docs/building-with-pay/deployment/vercel)
- [Deploy to Cloud Run with Terraform](/docs/building-with-pay/deployment/cloud-run)