Local development stack
The local stack runs the full platform — API, worker, scheduler, web app, Postgres, isolated
session and task Redis instances, and Vault — against the deterministic fake Perflo
adapter. Nothing leaves your machine: the API and web app bind to 127.0.0.1 only, and the
dev environment enables debug authentication so you can sign in without an Auth0 tenant.
The stack is defined in compose.yaml.
The api and web services publish on 127.0.0.1, not 0.0.0.0. The local stack is not reachable from another host without an overlay, and the dev-mode Vault root token (development-only-token) must never leave this machine. Do not expose this stack publicly.
Bring the stack up
Debug authentication
The development .env sets NEOBANK_DEBUG_AUTH_ENABLED=true. With debug authentication enabled, the API accepts a debug identity header instead of an Auth0 session. Production rejects this flag.
What is not here
The default local stack uses fake, so it makes no provider calls. Run make live-up to use live with PostgreSQL, both Redis authorities, local Vault, loopback application origins, explicit debug authentication, and the five reviewed HTTPS Perflo origins. See Single-server deployment and Production readiness.