# Self-host Coop

> A complete setup path for company owners, operations teams, and IT administrators.


Coop turns a Mac running Apple Messages into a shared team inbox. A self-hosted installation still has several parts because each part has a different job:

<div class="callout agent-callout"><strong>Prefer an AI-guided setup?</strong><p>Give your assistant the complete official documentation, answer a short interview, and work through only the steps your company needs.</p><a class="provider-action" href="/self-host/agent-setup/">Set up with an AI agent <span aria-hidden="true">→</span></a></div>

| Part | What it does | Recommended service |
| --- | --- | --- |
| Dashboard | The browser inbox your team uses | Vercel or Cloudflare |
| Clerk | Sign-in and verified identity | Clerk |
| Coop API | Access rules, sync, and message coordination | Railway or Fly.io |
| PostgreSQL | Organizations, conversations, and encrypted message records | Supabase |
| Redis | Encrypted recipient-search index | Railway Redis or another managed Redis |
| S3-compatible storage | Encrypted attachment files | Supabase Storage, Cloudflare R2, AWS S3, or MinIO |
| Coop Relay | Connects the API to Apple Messages | An always-on Mac |

<div class="callout"><strong>Recommended first installation</strong><p>Use Supabase for PostgreSQL and Storage, Railway for the API and Redis, Vercel for the dashboard, and Clerk for sign-in. This path has the fewest manual infrastructure steps.</p></div>

## What “self-hosted” means here

You control the Coop application, its configuration, the database account, the storage account, the deployment accounts, and the Mac. Clerk, Supabase, and the selected hosts are still external processors. If company policy requires every dependency to run on infrastructure that you operate, use your own PostgreSQL, Redis, and S3-compatible storage and review Clerk as a separate identity decision.

Coop encrypts private message content and attachments at rest with your `DATA_ENCRYPTION_KEY`. The API must decrypt data for authorized users, so this is server-managed encryption, not end-to-end encryption between Relay and the browser.

## Setup order

Follow the pages below in order. Record account ownership and URLs as you go. Do not deploy the API before you have the database, Redis, storage, Clerk, and encryption values ready.


## Pages

- [Set up Coop with an AI agent](/self-host/agent-setup/index.md): Give an AI assistant the complete Coop documentation, then let it build and guide only the setup path your company needs.
- [Prepare accounts and ownership](/self-host/prepare/index.md): Decide who owns the installation, collect the required accounts, and choose stable public URLs.
- [Set up Supabase](/self-host/supabase/index.md): Create PostgreSQL and private S3-compatible attachment storage without exposing Supabase keys to the browser.
- [Set up Clerk](/self-host/clerk/index.md): Create the production sign-in application and add the verified email claims that Coop invitations require.
- [Deploy the API on Railway](/self-host/backend-railway/index.md): Deploy the Coop API with a managed Redis service, safe migrations, and health checks.
- [Deploy the API on Fly.io](/self-host/backend-fly/index.md): Launch the API from its checked-in Fly configuration and attach managed data services.
- [Deploy the dashboard on Vercel](/self-host/frontend-vercel/index.md): Deploy the dashboard from the Coop release with its Clerk and API values.
- [Deploy the dashboard on Cloudflare Pages](/self-host/frontend-cloudflare/index.md): Build the dashboard from the Coop release and upload it directly to Cloudflare Pages.
- [Install and pair Coop Relay](/self-host/relay/index.md): Download the notarized Relay, point it at your API, grant permissions, and pair it to the organization.
- [Verify, back up, and operate](/self-host/verify-and-operate/index.md): Prove the complete path, document recovery, and give IT a repeatable operating checklist.