Apex
Personal finance and investment intelligence — net worth, spending and portfolio in one place, with an agent that proposes and you decide. Lives at apexfolios.com.
- Next.js 16 (App Router, TypeScript)
- Google sign-in via Auth.js, limited to an email allowlist
- Plaid for read-only balances, transactions and investment holdings
- Postgres (Neon) via Drizzle; Plaid access tokens encrypted with AES-256-GCM
- Shows sample data until a real account is connected
Security model
- Every page and API route requires a Google session (
proxy.ts + a second check in each page/route).
- Only emails in
ALLOWED_EMAILS can sign in; sessions expire after 12 hours.
- Bank logins happen inside Plaid Link — Apex never sees them. Apex only stores Plaid access tokens, encrypted with
ENCRYPTION_KEY.
- Plaid access is read-only. The agent proposes plans; you place every trade.
- Mutating API routes check same-origin. Secrets live only in environment variables — never in the repo.
1. Accounts and keys (one-time)
| What | Where | Env vars |
|---|
| Google OAuth client (type: Web application) | Google Cloud Console → APIs & Services → Credentials | AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET |
| Auth secret | openssl rand -base64 32 | AUTH_SECRET |
| Who can sign in | your Google email(s), comma-separated | ALLOWED_EMAILS |
| Plaid keys — start with Sandbox | dashboard.plaid.com → Developers → Keys | PLAID_CLIENT_ID, PLAID_SECRET, PLAID_ENV=sandbox |
| Postgres | Vercel → Storage → Neon (or neon.tech) | DATABASE_URL |
| Token encryption key | openssl rand -base64 32 | ENCRYPTION_KEY |
| Home value estimates (optional; free tier 50/month) | rentcast.io → API dashboard | RENTCAST_API_KEY |
| Cron secret for monthly home revaluation | openssl rand -base64 32 | CRON_SECRET |
| Mortgage address prefill via Plaid Liabilities (default on; free in Sandbox/Trial) | — | PLAID_LIABILITIES=off to disable |
Google OAuth authorized redirect URIs:
http://localhost:3000/api/auth/callback/google
https://apexfolios.com/api/auth/callback/google
2. Run locally
cp .env.example .env.local # fill in values — never commit this file
npm install
npm run db:push # creates the tables
npm run dev # http://localhost:3000
In Plaid Sandbox, pick any test bank and use Plaid's documented sandbox login (user_good / pass_good).
3. Deploy on Vercel
- vercel.com → Add New → Project → import
grehce/apex.
- Add every variable from
.env.example under Settings → Environment Variables.
- Deploy. Tables are created automatically during the Vercel build (
scripts/migrate.mjs).
- Every push to
main redeploys.
4. Point apexfolios.com at Vercel (Squarespace DNS)
- Vercel → Project → Settings → Domains → add
apexfolios.com (and www.apexfolios.com).
- Vercel shows the exact DNS records to create.
- Squarespace → Domains → apexfolios.com → DNS settings → add those records and remove conflicting Squarespace defaults for
@ and www.
- Wait for Vercel to show the domain as valid; it issues HTTPS automatically.
Moving Plaid to Production
Requires Plaid's production approval. Set PLAID_ENV=production and the production secret. Some banks use OAuth and need a registered redirect URI in the Plaid dashboard — that's a follow-up in the roadmap.
Project map
auth.ts Google sign-in + allowlist
proxy.ts route protection (Next 16 "proxy", formerly middleware)
lib/schema.ts tables: plaid_items, accounts, holdings, transactions, net_worth_daily
lib/sync.ts Plaid → database sync (accounts, holdings, /transactions/sync)
lib/data.ts builds the dashboard model (real or sample)
lib/plans.ts deterministic rebalancing plans for the agent
lib/property.ts home address/estimate helpers; lib/valuation.ts = RentCast behind a provider interface
app/api/property/ home value estimate preview; app/api/cron/revalue-homes = monthly re-estimate (vercel.json)
app/(app)/ overview, agent, settings pages
app/api/plaid/ link-token, exchange, sync, item (disconnect / include toggle)
Roadmap
- Editable allocation targets (defaults in
lib/model.ts)
- Conversational agent (LLM) on top of the deterministic plans
- Daily background sync (Vercel Cron) and Plaid webhooks
- Plaid OAuth redirect support for production banks
- Bond-fund detection (bond ETFs currently count under "Stocks & funds")
