# Set secrets
vercel env add SALESLOFT_CLIENT_ID production
vercel env add SALESLOFT_CLIENT_SECRET production
vercel env add SALESLOFT_WEBHOOK_SECRET production

# Deploy
vercel --prod

// api/webhooks/salesloft.ts (Vercel serverless function)
import { verifyWebhookSignature } from '../../lib/salesloft';

export const config = { api: { bodyParser: false } }; // Raw body for HMAC

export default async function handler(req: Request) {
  const body = await req.text();
  const sig = req.headers.get('x-salesloft-signature')!;
  const ts = req.headers.get('x-salesloft-timestamp')!;

  if (!verifyWebhookSignature(Buffer.from(body), sig, ts, process.env.SALESLOFT_WEBHOOK_SECRET!)) {
    return new Response('Invalid signature', { status: 401 });
  }

  const event = JSON.parse(body);
  // Process event...
  return new Response(JSON.stringify({ received: true }), { status: 200 });
}

# fly.toml
app = "salesloft-sync"
primary_region = "iad"

[env]
  NODE_ENV = "production"

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = true
  auto_start_machines = true

[[services.http_checks]]
  interval = "30s"
  timeout = "5s"
  path = "/health"

fly secrets set SALESLOFT_CLIENT_ID=xxx SALESLOFT_CLIENT_SECRET=xxx
fly secrets set SALESLOFT_WEBHOOK_SECRET=xxx
fly deploy

# Store secrets in Secret Manager
echo -n "client-id" | gcloud secrets create salesloft-client-id --data-file=-
echo -n "client-secret" | gcloud secrets create salesloft-client-secret --data-file=-

# Deploy with secret mounts
gcloud run deploy salesloft-sync \
  --image gcr.io/$PROJECT_ID/salesloft-sync \
  --region us-central1 \
  --set-secrets=SALESLOFT_CLIENT_ID=salesloft-client-id:latest \
  --set-secrets=SALESLOFT_CLIENT_SECRET=salesloft-client-secret:latest \
  --allow-unauthenticated

app.get('/health', async (req, res) => {
  const start = Date.now();
  try {
    const { data } = await api.get('/me.json');
    res.json({
      status: 'healthy',
      salesloft: { user: data.data.email, latencyMs: Date.now() - start },
    });
  } catch (err: any) {
    res.status(503).json({
      status: 'degraded',
      salesloft: { error: err.message, latencyMs: Date.now() - start },
    });
  }
});