Public pages and app pages have different jobs

A premium SaaS website needs crawlable public pages for search and conversion, while the authenticated workspace can behave like an app. Mixing those jobs often creates a site that is hard to index and an app that is awkward to use.

SignalPilot now uses public landing and blog routes for SEO, plus a Firebase-backed login and workspace flow for the product itself.

Apple Sign In belongs in the auth layer

On web, Apple Sign In should be configured as a Firebase Auth provider so the app can share user identity with callable functions, Firestore security rules, and subscription state.

The login page can stay simple: Apple as the production path, Google as an additional provider, and a local demo mode while Apple web auth or Stripe payment functions are still in launch setup.

Stripe Checkout should start on the server

Stripe secret keys never belong in a client bundle. The web app should call a Firebase function that creates the checkout session, validates redirect URLs, and sends the browser to Stripe.

Hosting rewrites then serve the SPA for app routes while preserving a webhook endpoint for Stripe events.