Persqo inside your app's admin. One prompt to set it up.

Add a Persqo admin page to this codebase. Persqo tests my live site your-app.example like a real visitor and shows the results, fix prompts and AI search (GEO) checks in a dashboard. Do not rebuild that dashboard: Persqo serves it, and this app only frames it for admins. First read the project to find its framework, its server code and its existing sign-in and admin checks, and follow the patterns it already uses.

Persqo project: prj_YOUR_PROJECT
Persqo site: env_YOUR_SITE (https://your-app.example)

1. The API key, server side only
Read the Persqo API key from a server-only environment variable named PERSQO_API_KEY. Add PERSQO_API_KEY= (empty) to .env.example, make sure .env and .env.local are in .gitignore, and tell me to put the real key in .env.local and in my host's environment settings. Never give it a NEXT_PUBLIC_, VITE_ or other public prefix, never import it in client code, never log it, and never ask me to paste it into chat or commit it.

2. The server code
Create a server-only endpoint (for example an API route or server action at /api/admin/persqo-embed) that:
1. Checks the caller is signed in as an admin with the app's existing auth. If not, returns 401 or 403.
2. Reads process.env.PERSQO_API_KEY (or the framework's server env). If it is missing, returns 500 with "Set PERSQO_API_KEY".
3. Calls Persqo with fetch:
POST https://persqo.com/api/v1/embed/sessions
Headers: Authorization: Bearer <the PERSQO_API_KEY secret>, Content-Type: application/json
Body: {"site_id": "env_YOUR_SITE", "platform": "claude"}
Answer (201): {"url": "...", "expires_at": "...", "verified": true or false, ...}
4. Returns only {"url": <the url from the answer>} with Cache-Control: no-store. Never returns or logs the key. If Persqo answers with an error, returns its status and its error.message.

3. The admin page
Create an admin page at /admin/persqo, named "Persqo", inside the existing admin layout, and add it to the admin navigation if there is one.
Each time the page opens, fetch the endpoint and put the returned url in an iframe: width 100%, height calc(100vh - the header height), no border, title "Persqo", allow="clipboard-write". Do not cache or store the url: it works once and only for five minutes, so a reload asks for a new one. Show a short loading line while it loads, and the error message with a Try again button if the call fails. If the app sends a Content-Security-Policy, add https://persqo.com to its frame-src (or child-src).

4. Who can open it
If the app has no sign-in or admin role, protect the page with a password instead: ask me for a second secret named PERSQO_DASHBOARD_PASSWORD. The page shows a password field; the server code compares what was typed with PERSQO_DASHBOARD_PASSWORD on the server, in constant time, before it calls Persqo, and refuses after 5 wrong tries in 10 minutes. Never put the password in client code, local storage or the URL. Hide the page from visitors who are not admins.

5. Site verification
Add this tag inside <head> of index.html (or the root layout's head), as it is served, not added later by a script, so Persqo can verify that I own the site:
<meta name="persqo-verification" content="YOUR_VERIFICATION_TOKEN">
If this codebase cannot edit the head, tell me, and I will add a DNS TXT record on your-app.example with the value persqo-verify=YOUR_VERIFICATION_TOKEN instead. Persqo frames its dashboard only on my verified domains and on localhost while I develop, so publish the change before opening the page on my own domain.

When you are done, tell me which files and functions you added, where the page is, and the name of the secret to fill in. Do not add anything else to the public site.

Yours has your own project and verification token, and never your API key.