# Postgres Database
INKEEP_AGENTS_RUN_DATABASE_URL=

OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://ingest.us.signoz.cloud:443/v1/traces
OTEL_EXPORTER_OTLP_TRACES_HEADERS=signoz-ingestion-key=<your-ingestion-key>

NANGO_SECRET_KEY=
NANGO_SERVER_URL=https://api.nango.dev

INKEEP_AGENTS_JWT_SIGNING_SECRET=
```

| Environment Variable                  | Value                                                                                                                                                                                                                                      |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ENVIRONMENT`                         | `production`                                                                                                                                                                                                                               |
| `ANTHROPIC_API_KEY`                   | Your Anthropic API key                                                                                                                                                                                                                     |
| `OPENAI_API_KEY`                      | Your OpenAI API key                                                                                                                                                                                                                        |
| `GOOGLE_GENERATIVE_AI_API_KEY`        | Your Google Gemini API key                                                                                                                                                                                                                 |
| `INKEEP_AGENTS_RUN_API_BYPASS_SECRET` | Run `openssl rand -hex 32` in your terminal to generate this value. Save this value for `INKEEP_AGENTS_RUN_API_BYPASS_SECRET` in Step 7.                                                                                                   |
| `INKEEP_AGENTS_RUN_DATABASE_URL`      | Postgres connection string from Step 3 (e.g., `postgresql://user:password@host:5432/database`)                                                                                                                                             |
| `NANGO_SECRET_KEY`                    | Nango secret key from your [Nango Cloud account](/typescript-sdk/credentials/nango). Note: Local Nango setup won't work with Vercel deployments.                                                                                           |
| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`  | `https://ingest.us.signoz.cloud:443/v1/traces`                                                                                                                                                                                             |
| `OTEL_EXPORTER_OTLP_TRACES_HEADERS`   | `signoz-ingestion-key=<your-ingestion-key>`. Use the instructions from [SigNoz Cloud Setup](/get-started/traces#option-1-signoz-cloud-setup) to configure your ingestion key. Note: Local SigNoz setup won't work with Vercel deployments. |
| `NANGO_SERVER_URL`                    | `https://api.nango.dev`                                                                                                                                                                                                                    |
| `INKEEP_AGENTS_JWT_SIGNING_SECRET`    | Run `openssl rand -hex 32` in your terminal to generate this value. Save this value for `INKEEP_AGENTS_JWT_SIGNING_SECRET` in Step 7.                                                                                                      |

### Step 8: Create a Vercel project for Manage UI

<img alt="Vercel New Project - Manage UI" src={__img2} placeholder="blur" />

<Note>
  The Framework Preset should be "Next.js" and the Root Directory should be
  `apps/manage-ui`.
</Note>

Required environment variables for Manage UI:

```dotenv
ENVIRONMENT=production

PUBLIC_INKEEP_AGENTS_RUN_API_URL=
PUBLIC_INKEEP_AGENTS_RUN_API_BYPASS_SECRET=

PUBLIC_INKEEP_AGENTS_MANAGE_API_URL=
INKEEP_AGENTS_MANAGE_API_URL=
INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET=

PUBLIC_SIGNOZ_URL=https://<your-organization>.signoz.cloud
SIGNOZ_API_KEY=

PUBLIC_NANGO_SERVER_URL=https://api.nango.dev
PUBLIC_NANGO_CONNECT_BASE_URL=https://connect.nango.dev
NANGO_SECRET_KEY=
```

| Environment Variable                         | Value                                                                                                                                                                                          |
| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ENVIRONMENT`                                | `production`                                                                                                                                                                                   |
| `PUBLIC_INKEEP_AGENTS_RUN_API_URL`           | Your Vercel deployment URL for Run API                                                                                                                                                         |
| `PUBLIC_INKEEP_AGENTS_RUN_API_BYPASS_SECRET` | Your generated Run API bypass secret from Step 6                                                                                                                                               |
| `PUBLIC_INKEEP_AGENTS_MANAGE_API_URL`        | Your Vercel deployment URL for Manage API (skip if same as `INKEEP_AGENTS_MANAGE_API_URL`)                                                                                                     |
| `INKEEP_AGENTS_MANAGE_API_URL`               | Your Vercel deployment URL for Manage API                                                                                                                                                      |
| `INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET`     | Your generated Manage API bypass secret from Step 5                                                                                                                                            |
| `PUBLIC_SIGNOZ_URL`                          | Use the instructions from [SigNoz Cloud Setup](/get-started/traces#option-1-signoz-cloud-setup) to configure your SigNoz URL. Note: Local SigNoz setup won't work with Vercel deployments.     |
| `SIGNOZ_API_KEY`                             | Use the instructions from [SigNoz Cloud Setup](/get-started/traces#option-1-signoz-cloud-setup) to configure your SigNoz API key. Note: Local SigNoz setup won't work with Vercel deployments. |
| `NANGO_SECRET_KEY`                           | Nango secret key from your [Nango Cloud account](/typescript-sdk/credentials/nango). Note: Local Nango setup won't work with Vercel deployments.                                               |
| `PUBLIC_NANGO_SERVER_URL`                    | `https://api.nango.dev`                                                                                                                                                                        |
| `PUBLIC_NANGO_CONNECT_BASE_URL`              | `https://connect.nango.dev`                                                                                                                                                                    |

### Step 9: Enable Vercel Authentication

To prevent anyone from being able to access the UI, we recommend enabling Vercel authentication for all deployments: **Settings > Deployment Protection > Vercel Authentication > All Deployments**.

### Step 10: Create a Vercel project for your MCP server (optional)

<img alt="Vercel New Project - MCP Server" src={__img3} placeholder="blur" />

<Note>
  The Framework Preset should be "Next.js" and the Root Directory should be
  `apps/mcp`.
</Note>

For more information on how to add MCP servers to your project, see [Create MCP Servers](/typescript-sdk/cli-reference#inkeep-add).

## Push your Agent

### Step 1: Configure your root .env file

```dotenv
INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET=
INKEEP_AGENTS_RUN_API_BYPASS_SECRET=
```

### Step 2: Create a cloud configuration file

Create a new configuration file named `inkeep-cloud.config.ts` in your project's `src` directory, alongside your existing configuration file.

```typescript
import { defineConfig } from "@inkeep/agents-cli/config";

const config = defineConfig({
  tenantId: "default",
  agentsManageApi: {
    url: "https://<your-manage-api-url>",
    apiKey: process.env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET,
  },
  agentsRunApi: {
    url: "https://<your-run-api-url>",
    apiKey: process.env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET,
  },
});

export default config;
```

### Step 3: Push your Agent

```bash
cd /src/<your-project-directory>
inkeep push --config ../inkeep-cloud.config.ts
```

## Pull your Agent

```bash
cd /src
inkeep pull --config inkeep-cloud.config.ts
```

## Function Tools with Vercel Sandbox

When deploying to serverless environments like Vercel, you can configure [function tools](/typescript-sdk/tools/function-tools) to execute in [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) MicroVMs instead of your Agent's runtime service. This is **required** for serverless platforms since child process spawning is restricted.

### Why Use Vercel Sandbox?

**When to use each provider:**

* **Native** - Use for traditional cloud deployments (VMs, Docker, Kubernetes), self-hosted servers, or local development
* **Vercel Sandbox** - Required for serverless platforms (Vercel, AWS Lambda, etc.) or if you'd like to isolate tool executions

### Setting Up Vercel Sandbox

#### Step 1: Get Vercel Credentials

You'll need three credentials from your Vercel account:

1. **Vercel Token** - Create an access token at [vercel.com/account/tokens](https://vercel.com/account/tokens)
2. **Team ID** - Find in your team settings at [vercel.com/teams](https://vercel.com/teams)
3. **Project ID** - Find in your Vercel project settings

#### Step 2: Configure Sandbox in Your Application

Update your Run API to use Vercel Sandbox.

In the `apps/run-api/src` folder, create a `sandbox.ts` file:

```typescript sandbox.ts
const isProduction = process.env.ENVIRONMENT === "production";

export const sandboxConfig = isProduction
  ? {
      provider: "vercel",
      runtime: "node22", // or 'typescript'
      timeout: 60000, // 60 second timeout
      vcpus: 4, // Allocate 4 vCPUs
      teamId: process.env.SANDBOX_VERCEL_TEAM_ID!,
      projectId: process.env.SANDBOX_VERCEL_PROJECT_ID!,
      token: process.env.SANDBOX_VERCEL_TOKEN!,
    }
  : {
      provider: "native",
      runtime: "node22",
      timeout: 30000,
      vcpus: 2,
    };
```

Import it into your `index.ts` file:

```typescript index.ts
import { sandboxConfig } from "./sandbox.ts";
// ...
const app: Hono = createExecutionApp({
  // ...
  sandboxConfig, // NEW
});
```

#### Step 3: Add Environment Variables to Run API

Add these [environment variables in your Vercel project](https://vercel.com/docs/environment-variables/managing-environment-variables#declare-an-environment-variable) to your **Run API** app:

```dotenv
SANDBOX_VERCEL_TOKEN=your_vercel_access_token
SANDBOX_VERCEL_TEAM_ID=team_xxxxxxxxxx
SANDBOX_VERCEL_PROJECT_ID=prj_xxxxxxxxxx
```

<Accordions>
  <Accordion title="Troubleshooting Functions">
    <strong>
      "Failed to refresh OIDC token" error:
    </strong>

    <ul>
      <li>
        This occurs when you're not in a Vercel environment or you don't provide a Vercel access token
      </li>

      <li>
        Solution: Use a Vercel access token from
        <a href="https://vercel.com/account/tokens" target="_blank" rel="noopener noreferrer">vercel.com/account/tokens</a>
      </li>
    </ul>

    <strong>
      Function execution timeouts:
    </strong>

    <ul>
      <li>
        Increase the 

        <code>timeout</code>

         value in sandbox configuration
      </li>

      <li>
        Consider allocating more 

        <code>vcpus</code>

         for resource-intensive functions
      </li>

      <li>
        Check Vercel Sandbox limits for your plan
      </li>
    </ul>

    <strong>
      Dependency installation failures:
    </strong>

    <ul>
      <li>
        Ensure dependencies are compatible with Node.js 22
      </li>

      <li>
        Check that package versions are specified correctly
      </li>

      <li>
        Verify network access to npm registry
      </li>
    </ul>

    <strong>
      High costs:
    </strong>

    <ul>
      <li>
        Reduce 

        <code>vcpus</code>

         allocation if functions don't need maximum resources
      </li>

      <li>
        Optimize function code to execute faster
      </li>

      <li>
        Consider caching results when possible
      </li>
    </ul>
  </Accordion>

  <Accordion title="Best Practices">
    <ol>
      <li>
        <strong>Use environment variables</strong>

         – Never hardcode credentials
      </li>

      <li>
        <strong>Start with fewer vCPUs</strong>

         – Scale up only if needed
      </li>

      <li>
        <strong>Set reasonable timeouts</strong>

         – Prevent runaway executions
      </li>

      <li>
        <strong>Monitor usage</strong>

         – Track sandbox execution metrics in Vercel dashboard
      </li>

      <li>
        <strong>Test thoroughly</strong>

         – Verify functions work in sandbox environment before deploying
      </li>

      <li>
        <strong>Choose the right provider</strong>

         – Use native for VMs/Docker/K8s, Vercel Sandbox for serverless only
      </li>
    </ol>

    <p>
      For more information on function tools, see:
    </p>

    <ul>
      <li>
        <a href="/typescript-sdk/tools/function-tools">
          Function Tools (TypeScript SDK)
        </a>
      </li>

      <li>
        <a href="/visual-builder/tools/function-tools">
          Function Tools (Visual Builder)
        </a>
      </li>

      <li>
        <a href="https://vercel.com/docs/vercel-sandbox" target="_blank" rel="noopener noreferrer">
          Vercel Sandbox Documentation
        </a>
      </li>
    </ul>
  </Accordion>
</Accordions>

## Deployment Protection

The Inkeep Agent Framework provides health endpoints for Kubernetes-style probes and optional integration with Vercel Checks for automated deployment protection.

### Health Endpoints

Two health endpoints are available for monitoring deployment readiness:

#### `/health` - Liveness Probe

A lightweight endpoint that returns immediately to indicate the service is running.

* **Response**: HTTP 204 (No Content)
* **Use case**: Kubernetes liveness probes, load balancer health checks
* **Latency**: Sub-millisecond (no external calls)

```bash
curl -I https://your-api.vercel.app/health