Smash Collab
Smash Collab is a swipe-style app where YouTube creators find collab partners.
Creators verify their channel with Google (read-only YouTube access), pick their
niches, then Pass or Collab with other creators. When two creators both
send a collab it's a match, and they can message. Free creators get 4 collabs a day
to channels under 5,000 subscribers; Plus (Stripe) removes both limits.
Live site: https://smashcollab.com
Stack
- TanStack Start (React 19, Vite) deployed on Vercel (Nitro
vercel preset)
- Firebase Auth (Google) + Cloud Firestore for profiles, swipes, matches, messages
- YouTube verification via Google OAuth (
/api/youtube/start → /api/youtube/callback)
- Stripe Checkout + webhook for Plus and extra collabs; entitlements stored in
Firestore (server-side, keyed by YouTube channel ID)
Develop
npm install
npm run dev # http://localhost:8080
npm run build # production build (.vercel/output)
npm run typecheck
npm run lint
npm test
Environment variables
| Name | Where | Purpose |
|---|
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI | server | YouTube/Google OAuth. The secret also signs session cookies. |
VITE_FIREBASE_* | client + server | Firebase web config (project smash-collab). Public by design. |
FIREBASE_SERVICE_ACCOUNT | server | Service-account JSON (raw or base64) used to store Plus entitlements, Stripe sessions and invite rewards in Firestore. Required for payments. |
STRIPE_SECRET_KEY | server | Stripe secret key. Live keys (sk_live_…) are refused unless STRIPE_ALLOW_LIVE=true. |
STRIPE_WEBHOOK_SECRET | server | Signing secret of the Stripe webhook endpoint. |
STRIPE_ALLOW_LIVE | server | Set to true only when you are ready to take real payments. |
STRIPE_PRICE_PLUS_MONTHLY, STRIPE_PRICE_PLUS_ANNUAL, STRIPE_PRICE_PITCH | server | Optional fixed Stripe price IDs (otherwise created/looked up by lookup key). |
PLUS_COOKIE_SECRET | server | Dedicated secret for the signed matchcut_plus cookie (falls back to the Google client secret for now). |
PLUS_COMP_EMAILS, PLUS_COMP_CHANNEL_IDS | server | Comma-separated tester allowlist that gets free Plus. Checked on the server against the verified Google email / YouTube channel ID. |
Firestore rules
Security rules and indexes live in firestore.rules / firestore.indexes.json.
Deploy them with the Firebase CLI:
npx firebase-tools deploy --only firestore:rules,firestore:indexes --project smash-collab
Stripe webhook
Endpoint: https://smashcollab.com/api/stripe/webhook with events
checkout.session.completed, checkout.session.async_payment_succeeded,
customer.subscription.updated, customer.subscription.deleted.
Rules tests (needs Java for the Firestore emulator): npm run test:rules.
