Recommended Steps (OrgaHero)

Next operational steps

• Verify Google Login on https://orga-hero.com and https://www.orga-hero.com end-to-end.
• Keep observing API logs for /api/coach/google-auth?action=start and confirm redirect_uri stays exactly one valid callback URL.
• Verify account session persistence after F5 on desktop/mobile browsers (session via /api/auth/me with cookie fallback).

OAuth config checklist

• Keep APP_PUBLIC_URL as a single URL (no comma-separated list).
• Keep ALLOWED_ORIGINS as comma-separated list only for CORS.
• In Google Cloud Console, ensure the redirect URI includes:
  • https://orga-hero.com/api/coach/google-auth?action=callback

Risks / follow-up

• If users still login via www/classic, decide whether canonical callback origin should remain apex-only or switch to dedicated auth domain.
• .env.production contains live credentials; if any were ever exposed outside trusted server scope, rotate them (Google, DB, Telegram, Brevo, session secret).
• scripts/sync-orgahero-production.sh currently can fail at docker compose parse with server-control-plane/.env permission errors; either fix file permissions for github-runner or run the final docker compose up -d --no-deps orga-hero caddy step with sufficient permissions.