# your stack

How your secrets get to your VM, and the one step sign-in needs.
## What runs

Your VM runs your project the way your laptop does: the web app plus any other processes it needs, each started with its usual command. Your agent works out which ones by reading the repo. For what we've tested and what should work, see [what's supported](supported.md).

## Env files and secrets

Your env files go from your laptop straight to your VM. Telescope passes them through and never stores them. To update them, edit the file on your laptop and ask your agent to update the preview (`telescope env push`). Deleting the VM deletes them too.

> **Careful**
> Everything on your VM is real. A button that calls a paid API spends real money when you tap it. Use dev or test keys with a spend cap, never production secrets.

## Sign-in

Sign-in providers only send people back to addresses they know, so add your VM's address once per project. Your agent gives you the exact URL. By provider:

| Provider | What to add |
| --- | --- |
| Supabase Auth | Redirect URL `https://<your-vm>/auth/callback**` |
| Auth.js | A callback `https://<your-vm>/api/auth/callback/<provider>`: for GitHub, a separate OAuth app; for Google, add it to the client's redirect URIs |
| Clerk | Nothing for dev instances; add the domain for production instances |

Use redirect sign-in, not popups; popups don't work on the phone.