Admin go-live: set secrets + WorkOS redirect for the nhimbe-admin Vercel project

[bryanfawcett]

The admin/ app is merged, the nhimbe-admin Vercel project is created (root dir admin), admin.nhimbe.com domain + Cloudflare DNS are wired, non-secret env is set, and a production deploy is READY (currently 503 by design until the secrets below are in). Manual steps to make it serve:

1. Secrets — nhimbe-admin Vercel project (Production + Preview)

Write-only, so they must be pasted (same values as the public nhimbe project):

• WORKOS_API_KEY
• WORKOS_COOKIE_PASSWORD
• MONGODB_URI

2. Recommended env

• WORKOS_ADMIN_ORG_ID = the nyuchi WorkOS org_… id (precise, lookup-free org gate). If unset, the gate resolves the org by the nyuchi.com domain and caches it per process.

3. WorkOS dashboard (same environment as the API key)

• Add https://admin.nhimbe.com/callback to the AuthKit redirect-URI allow-list.

4. Redeploy

• After the secrets are set, redeploy nhimbe-admin (push, Vercel "Redeploy", or ask Claude to trigger it).

Already done (no action): project + git link + root dir admin, admin.nhimbe.com domain verified, Cloudflare CNAME (DNS-only), WORKOS_CLIENT_ID / WORKOS_API_HOSTNAME / NEXT_PUBLIC_SITE_URL / NEXT_PUBLIC_WORKOS_REDIRECT_URI set. Gate is nyuchi-org-scoped + RBAC-hardened (#77, #78). See admin/README.md.

Related: #69 (admin extraction).

[linear]

NYU-32