# Connection — BrandApp Playground

> Swap the BrandApp credentials this deployment uses, stored in an encrypted httpOnly cookie.

- Canonical page: https://brandapp-playground.vercel.app/connection
- Markdown: https://brandapp-playground.vercel.app/connection.md

## What it does

Shows which credential source is active — `custom` (cookie), `env`, `dev`, or
`unconfigured` — and lets you point the playground at a different BrandApp without
editing `.env`.

## How the credentials are stored

- Encrypted with AES-256-GCM before they are written to the `reopt-playground-config`
  cookie. Plaintext never reaches cookie storage.
- `httpOnly`, `sameSite=strict`, 30-day lifetime.
- The key comes from `PLAYGROUND_COOKIE_SECRET`, falling back to `BETTER_AUTH_SECRET`.
- Custom API origins must be allow-listed in `PLAYGROUND_ALLOWED_BASE_URLS`.

## Public deployments

Server environment credentials are never handed to anonymous visitors. Each visitor
connects their own BrandApp. A private deployment behind its own access boundary can
opt in with `PLAYGROUND_ALLOW_SHARED_ENV_CREDENTIALS=true`.

Authentication (Better Auth) always uses environment variables and is not switchable at
runtime — only the data modules (EAV, AI, CMS, Files) follow the cookie.

## API

- `GET /api/connection` — current mode plus masked credentials
- `POST /api/connection` — store credentials
- `DELETE /api/connection` — clear the cookie and revert to the deployment default

## Related

- [Health Check](https://brandapp-playground.vercel.app/health.md)
- [Quick Start](https://brandapp-playground.vercel.app/getting-started.md)

---

Index of every document: https://brandapp-playground.vercel.app/llms.txt
Single-file copy: https://brandapp-playground.vercel.app/llms-full.txt
HTTP API description: https://brandapp-playground.vercel.app/openapi.json