Admin Security Checklist

Who gets in

• Move the admin to its own subdomain as a separate Vercel projectA shared domain lets a scripting bug on the public site ride the admin session.
• Give the admin its own env vars and a least-privilege database roleShared secrets and roles mean one leak in the public app exposes everything the admin can touch.
• Check a verified email against an explicit allowlist in the signIn callbackGoogle proves who someone is, not that they should run your business.
• Store each admin's role in your own database, not the Google profileWithout your own role record, you cannot decide or change what each admin is allowed to do.
• Require a passkey or security key, and avoid SMS codes for adminsApp codes can be phished and SMS can be SIM-swapped, while a passkey is bound to your domain.
• Re-prompt for the second factor before refunds, exports and role changesOne hijacked session could otherwise drain funds or export every customer record at once.