Setup checker

Is ScanZX ready to run?

Green means working. Grey means the feature is off until you add a key to .env — the app still runs and clearly labels missing data. Values are never displayed here, only presence.

NOT CONFIGURED

Database (SQLite dev fallback via Prisma)

Not reachable. Local dev: npm run db:dev. Production: set a PostgreSQL DATABASE_URL and run npm run prisma:deploy.

NOT CONFIGURED

Authentication (first-party sessions)

Unavailable: accounts need a reachable database. Sign-in, sign-up and password reset all fail until DATABASE_URL resolves.

NOT CONFIGURED

Billing (Stripe subscriptions)

Payments disabled (no STRIPE_SECRET_KEY). Checkout returns an honest 503 — paid access is never faked.

READY

iOS subscriptions (Apple In-App Purchase)

App Store Server Notifications V2 endpoint /api/apple/notifications verifies Apple-signed payloads against the pinned Apple Root CA (no shared secret needed). Product IDs: com.scanzx.app.pro.monthly, com.scanzx.app.advanced.monthly (create these in App Store Connect — docs/IOS_APP_STORE_SUBMISSION.md). Sandbox entitlements are disabled (set APPLE_ALLOW_SANDBOX_ENTITLEMENTS=1 on the deployment serving TestFlight/App Review).

OPTIONAL

Transactional email (Resend)

Setup required for email: outbox rows queue safely but nothing sends until RESEND_API_KEY and EMAIL_FROM are set.

READY

Scheduled monitoring (CRON_SECRET)

CRON_SECRET set — /api/cron/monitoring accepts the scheduler. vercel.json requests a 6-hour cadence (Vercel Hobby supports daily only; use Pro or an external scheduler for 6-hourly Advanced monitoring).

OPTIONAL

Rate limiting (Upstash Redis)

Production readiness requires UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN; the in-memory dev fallback is not effective across serverless instances.

READY

Cookie signing (APP_SIGNING_SECRET)

Referral attribution cookies are signed with a persistent secret.

OPTIONAL

Feature flags

referral discounts: coming soon · API access: coming soon · team workspaces: coming soon · PDF exports: coming soon. Flags stay off until each capability is configured and verified — nothing is shown as live before then.

READY

On-chain reads (viem)

Token name, symbol, decimals, supply, and owner are read from public RPC endpoints for Ethereum, Base, BSC, Arbitrum, and Polygon. No key needed.

READY

Universal market data (DexScreener)

Liquidity, price, volume, pair age, buy/sell counts, boosts, and paid orders come from the public DexScreener API for ANY chain DexScreener lists — this powers the baseline market scan for non-EVM chains. No key needed. Override host with DEXSCREENER_API_BASE_URL.

NOT CONFIGURED

Solana deep checks (SPL mint/freeze authority)

Set SOLANA_RPC_URL (e.g. https://api.mainnet-beta.solana.com or a Helius RPC URL) to enable mint/freeze authority checks. Without it, Solana tokens still get the baseline market scan with those checks honestly listed as unavailable. Optional (planned): HELIUS_API_KEY, RUGCHECK_API_BASE_URL, RUGCHECK_API_KEY, BIRDEYE_API_KEY.

READY

Security data (GoPlus)

Honeypot, tax, mint/blacklist flags, and holder data use the public GoPlus API under public rate limits. GOPLUS_API_KEY is accepted but the authenticated flow is not implemented yet.

NOT CONFIGURED

Explorer source verification (0/5 chains)

Set ETHERSCAN_API_KEY in .env (one free Etherscan key covers all five chains via the V2 API). Without it, source verification shows as unavailable and confidence is lower.

OPTIONAL

Push notifications (VAPID)

Optional. In-app alerts work without push keys. Add NEXT_PUBLIC_VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, and VAPID_SUBJECT to prepare push.

OPTIONAL

Telegram bot

Optional. Set TELEGRAM_BOT_TOKEN and TELEGRAM_WEBHOOK_SECRET to enable /scan, /watch, /report, and /help in your group. Until then the webhook answers 'not configured'.

READY

Localisation (English · Español · Français)

Interface dictionaries for en/es/fr ship with key-parity tests (npm run test:i18n). Locale precedence: account preference → cookie → browser Accept-Language → English. Primary marketing/scanner surfaces are translated; remaining app screens fall back to English safely (never raw keys) — see docs/INTERNATIONALISATION.md for coverage.

OPTIONAL

Local-currency display (GBP base)

Setup required for estimated local prices: set PRICING_FX_RATES (admin-maintained rates). Until then non-GBP visitors see GBP with an honest 'shown at secure checkout' note. Country detection uses the Vercel geolocation header (suggestion only; explicit choice always wins; localhost defaults to GBP). Exact charged amounts always come from Stripe — enable Adaptive Pricing in the Stripe Dashboard for local presentment currencies (docs/CURRENCY_LOCALISATION.md).

OPTIONAL

Narrative social signals

Narrative analysis works today from naming heuristics and scan history. Social momentum providers (X, Telegram, Discord, Reddit, Trends…) are planned — reports honestly list them as unavailable, which lowers narrative confidence only.

Quick start (Windows)

Run setup.bat once (installs dependencies, creates the database).
Run dev.bat (starts the dev server).
Open http://localhost:3000/scanner and paste a token address.

Recommended next step: get a free API key at etherscan.io and set ETHERSCAN_API_KEY in .env — it unlocks source verification on all five chains.