> ## Documentation Index
> Fetch the complete documentation index at: https://docs.highailabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments

> Production, local development, and preview deployment URLs with CORS configuration.

## Overview

The High IQ API runs in three distinct environments. Each has its own URL, CORS policy, and behavior characteristics. The API is deployed on Vercel Edge Functions, with preview deployments automatically created for pull requests.

## Environment URLs

| Environment    | Base URL                                           | Use Case                          |
| -------------- | -------------------------------------------------- | --------------------------------- |
| **Production** | `https://api.thisiswhyimhigh.com`                  | Live traffic, mobile app, website |
| **Local**      | `http://localhost:3001`                            | Development and testing           |
| **Preview**    | `https://tiwih-api-{hash}-high-ai-labs.vercel.app` | PR review and staging             |

### Production

<Note>
  The production API migrated from `tiwih-api.vercel.app` to `api.thisiswhyimhigh.com` in June 2026. If you have the old domain in any integrations, update it — the legacy `.vercel.app` domain is deprecated.
</Note>

The production API is deployed on Vercel Edge Functions with automatic deployments on every merge to `main`. It serves:

* The [High IQ mobile app](https://highiq.app) (iOS)
* The [This Is Why I'm High website](https://thisiswhyimhigh.com)
* The [High IQ web app](https://highiq-web-app.vercel.app)

```bash theme={null}
curl "https://api.thisiswhyimhigh.com/api/v1/strains/popular"
```

### Local Development

For local development, the API runs on port 3001. Rate limiting and authentication are disabled in development mode for easier testing.

```bash theme={null}
# Start the API locally
cd apps/api && pnpm dev

# Test locally
curl "http://localhost:3001/api/v1/strains/search?q=kush"
```

### Preview Deployments

Every pull request gets an automatic preview deployment on Vercel. Preview URLs follow the pattern:

```
https://tiwih-api-{branch-slug}-high-ai-labs.vercel.app
```

These deployments are useful for testing API changes before merging to production.

## CORS Configuration

The API enforces Cross-Origin Resource Sharing (CORS) to control which domains can make requests from browser-based clients. CORS policies differ by environment.

### Allowed Origins

<Tabs>
  <Tab title="Production">
    ```
    https://thisiswhyimhigh.com
    https://www.thisiswhyimhigh.com
    https://highiq.app
    https://www.highiq.app
    https://api.highiq.app
    https://highiq-web-app.vercel.app
    https://tiwih-website.vercel.app
    https://api.thisiswhyimhigh.com
    ```
  </Tab>

  <Tab title="Development">
    ```
    http://localhost:3000
    http://localhost:4321
    http://localhost:8081
    http://localhost:19000
    http://localhost:19006
    ```

    Any `http://localhost` origin is allowed in development.
  </Tab>

  <Tab title="Preview Deployments">
    Preview deployment URLs are allowed via pattern matching:

    ```
    https://highiq-web-app-{hash}-high-ai-labs.vercel.app
    https://tiwih-website-{hash}-high-ai-labs.vercel.app
    https://tiwih-api-{hash}-high-ai-labs.vercel.app
    ```

    The pattern uses `[a-zA-Z0-9-]+` to prevent subdomain injection attacks (no dots allowed in the hash segment).
  </Tab>
</Tabs>

### CORS Headers

For allowed origins, the API responds with these headers:

```
Access-Control-Allow-Origin: https://thisiswhyimhigh.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization, Accept
```

### Preflight Requests

The API handles CORS preflight (`OPTIONS`) requests automatically. For SSE streaming endpoints, preflight includes:

```
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization, Accept
```

<Note>
  CORS credentials mode is set to `false` for streaming endpoints. Cookies and credentials are not sent cross-origin for SSE connections.
</Note>

## Environment-Specific Behavior

Several API behaviors change based on the environment:

| Behavior            | Production      | Development                                          |
| ------------------- | --------------- | ---------------------------------------------------- |
| Rate limiting       | Enforced        | Disabled                                             |
| Admin auth          | Required        | Bypassed                                             |
| Bearer auth         | Required        | Bypassed (if env vars not set)                       |
| Error stack traces  | Hidden          | Included in response                                 |
| Cache debug headers | Not sent        | `X-Endpoint-Type`, `X-Cache-Strategy`, `X-Cache-TTL` |
| Request logging     | Structured JSON | Console with details                                 |
| Database errors     | Generic message | Full error details                                   |

### Debug Headers (Development Only)

When running locally, the API includes additional debug headers on responses:

```
X-Endpoint-Type: catalog
X-Cache-Strategy: enabled
X-Cache-TTL: 300
X-Cache-MaxAge: 300
```

These headers are stripped in production.

## Vercel Edge Runtime

The API runs on Vercel's Edge Runtime, which provides:

* **Global distribution**: Requests are served from the edge location closest to the user
* **Cold start performance**: Edge Functions have near-zero cold start times
* **Auto-scaling**: Scales automatically with traffic
* **Automatic HTTPS**: All production and preview URLs use TLS

### Limitations

Edge Functions have some constraints to be aware of:

* **Execution time**: 30-second maximum per request (streaming endpoints can run longer via SSE)
* **Memory**: Limited memory per invocation
* **No filesystem**: No local file system access (all data comes from Supabase or external APIs)
* **Node.js APIs**: A subset of Node.js APIs are available (no `fs`, `child_process`, etc.)

## Health Check

Verify the API is running and responsive:

```bash theme={null}
curl "https://api.thisiswhyimhigh.com/health"
```

```json theme={null}
{
  "status": "ok",
  "timestamp": "2026-02-16T12:00:00.000Z"
}
```

The streaming service has its own health endpoint:

```bash theme={null}
curl "https://api.thisiswhyimhigh.com/api/v1/notebooks/stream/health"
```

```json theme={null}
{
  "available": true,
  "service": "section-streaming",
  "timestamp": "2026-02-16T12:00:00.000Z",
  "aiSectionsCount": 12
}
```