Optional Sign in with Vercel on /dev-console (PKCE authorize + callback + logout) that sets a signed HttpOnly identity session cookie for Flags identify
interactiveRedesign now uses a deduped identify returning { user?: { id, email } } so Segments can target Dylan by email/sub
Wired NEXT_PUBLIC_VERCEL_APP_CLIENT_ID / VERCEL_APP_CLIENT_SECRET through config/env.secrets.keys
Docs: colocated how-it-works at apps/web/src/auth/vercel/README.md, with short pointers from root README.md (Env Vars) and AGENTS.md (Environment / secrets + agent surfaces)

Human dashboard checklist (required before it works)

Vercel → Team Settings (dylan-gattey) → Apps → Create app
Authorization callback URLs:
- http://localhost:3000/api/auth/vercel/callback
- https://dylangattey.com/api/auth/vercel/callback
- Optionally preview project URL /api/auth/vercel/callback
Permissions / scopes: openid, email, profile (skip offline_access — we store a signed session, not Vercel refresh tokens)
Copy Client ID + Client Secret into project env (Preview + Production) and 1Password vault dg items (same names, value field):
- NEXT_PUBLIC_VERCEL_APP_CLIENT_ID
- VERCEL_APP_CLIENT_SECRET
Flags → Entities: user with string attributes id, email
Flags → Segments: e.g. dylan with user.email equals hi@dylangattey.com or user.id equals <sub from first login>
Flag interactive-redesign → target segment dylan → true

Security: any Vercel account can complete OAuth. “Just me” is the segment rule on your id/email, not the login button.

How to verify