diff --git a/.gitignore b/.gitignore
index dd869c380b..0291da0a6c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,6 +69,7 @@ deps/shui/.lsp-cache
 deps/shui/.clj-kondo
 deps/publish/worker/.wrangler
 deps/publish/worker/dist
+deps/publish/worker/.env*
 
 tx-log*
 clj-e2e/.wally
diff --git a/deps/publish/src/logseq/publish/common.cljs b/deps/publish/src/logseq/publish/common.cljs
index 507b7a2449..59afb01111 100644
--- a/deps/publish/src/logseq/publish/common.cljs
+++ b/deps/publish/src/logseq/publish/common.cljs
@@ -226,8 +226,8 @@
              payload (decode-jwt-part payload-part)
              issuer (aget env "COGNITO_ISSUER")
              client-id (aget env "COGNITO_CLIENT_ID")
-             _ (when (not= (aget payload "iss") issuer) (throw (ex-info "iss" {})))
-             _ (when (not= (aget payload "aud") client-id) (throw (ex-info "aud" {})))
+             _ (when (not= (aget payload "iss") issuer) (throw (ex-info "iss not found" {})))
+             _ (when (not= (aget payload "aud") client-id) (throw (ex-info "aud not found" {})))
              now (js/Math.floor (/ (.now js/Date) 1000))
              _ (when (and (aget payload "exp") (< (aget payload "exp") now))
                  (throw (ex-info "exp" {})))
diff --git a/deps/publish/worker/wrangler.toml b/deps/publish/worker/wrangler.toml
index 6dac02dd6e..9405bcb99f 100644
--- a/deps/publish/worker/wrangler.toml
+++ b/deps/publish/worker/wrangler.toml
@@ -22,11 +22,49 @@ binding = "PUBLISH_R2"
 bucket_name = "logseq-publish-dev"
 
 [vars]
-COGNITO_JWKS_URL = "https://cognito-idp.us-east-1.amazonaws.com/POOL_ID/.well-known/jwks.json"
-COGNITO_ISSUER = "https://cognito-idp.us-east-1.amazonaws.com/POOL_ID"
-COGNITO_CLIENT_ID = "CLIENT_ID"
-R2_ACCOUNT_ID = "YOUR_ACCOUNT_ID"
-R2_BUCKET = "logseq-publish-dev"
-R2_ACCESS_KEY_ID = "R2_ACCESS_KEY_ID"
-R2_SECRET_ACCESS_KEY = "R2_SECRET_ACCESS_KEY"
+COGNITO_JWKS_URL = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8/.well-known/jwks.json"
+COGNITO_ISSUER = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8"
+COGNITO_CLIENT_ID = "69cs1lgme7p8kbgld8n5kseii6"
 DEV_SKIP_AUTH = "true"
+
+[env.staging]
+name = "logseq-publish-staging"
+
+[env.staging.vars]
+COGNITO_JWKS_URL = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8/.well-known/jwks.json"
+COGNITO_ISSUER   = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8"
+COGNITO_CLIENT_ID = "69cs1lgme7p8kbgld8n5kseii6"
+DEV_SKIP_AUTH = "true"
+
+[[env.staging.durable_objects.bindings]]
+name = "PUBLISH_META_DO"
+class_name = "PublishMetaDO"
+
+[[env.staging.migrations]]
+tag = "v2"
+new_sqlite_classes = ["PublishMetaDO"]
+
+[[env.staging.r2_buckets]]
+binding = "PUBLISH_R2"
+bucket_name = "logseq-publish-dev"
+
+[env.prod]
+name = "logseq-publish-prod"
+
+[env.prod.vars]
+COGNITO_JWKS_URL = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8/.well-known/jwks.json"
+COGNITO_ISSUER   = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_dtagLnju8"
+COGNITO_CLIENT_ID = "69cs1lgme7p8kbgld8n5kseii6"
+DEV_SKIP_AUTH = "true"
+
+[[env.prod.durable_objects.bindings]]
+name = "PUBLISH_META_DO"
+class_name = "PublishMetaDO"
+
+[[env.prod.migrations]]
+tag = "v2"
+new_sqlite_classes = ["PublishMetaDO"]
+
+[[env.prod.r2_buckets]]
+binding = "PUBLISH_R2"
+bucket_name = "logseq-publish-prod"
diff --git a/src/main/frontend/config.cljs b/src/main/frontend/config.cljs
index 0066454260..b8e4aee374 100644
--- a/src/main/frontend/config.cljs
+++ b/src/main/frontend/config.cljs
@@ -25,7 +25,7 @@
 ;; when it launches (when pro plan launches) it should be removed
 (def ENABLE-SETTINGS-ACCOUNT-TAB false)
 
-(def PUBLISH-API-BASE "http://localhost:8787")
+;; (def PUBLISH-API-BASE "http://localhost:8787")
 
 (if ENABLE-FILE-SYNC-PRODUCTION
   (do (def LOGIN-URL
@@ -36,7 +36,8 @@
       (def REGION "us-east-1")
       (def USER-POOL-ID "us-east-1_dtagLnju8")
       (def IDENTITY-POOL-ID "us-east-1:d6d3b034-1631-402b-b838-b44513e93ee0")
-      (def OAUTH-DOMAIN "logseq-prod.auth.us-east-1.amazoncognito.com"))
+      (def OAUTH-DOMAIN "logseq-prod.auth.us-east-1.amazoncognito.com")
+      (def PUBLISH-API-BASE "https://logseq.io"))
 
   (do (def LOGIN-URL
         "https://logseq-test2.auth.us-east-2.amazoncognito.com/login?client_id=3ji1a0059hspovjq5fhed3uil8&response_type=code&scope=email+openid+phone&redirect_uri=logseq%3A%2F%2Fauth-callback")
@@ -46,7 +47,8 @@
       (def REGION "us-east-2")
       (def USER-POOL-ID "us-east-2_kAqZcxIeM")
       (def IDENTITY-POOL-ID "us-east-2:cc7d2ad3-84d0-4faf-98fe-628f6b52c0a5")
-      (def OAUTH-DOMAIN "logseq-test2.auth.us-east-2.amazoncognito.com")))
+      (def OAUTH-DOMAIN "logseq-test2.auth.us-east-2.amazoncognito.com")
+      (def PUBLISH-API-BASE "https://logseq-publish-staging.logseq.workers.dev")))
 
 (goog-define ENABLE-RTC-SYNC-PRODUCTION false)
 (if ENABLE-RTC-SYNC-PRODUCTION