> For the complete documentation index, see [llms.txt](https://docs.voveid.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.voveid.com/docs/production-readiness.md).

# Production checklist

Checklist for promoting a tested VOVE ID integration to Production.

Sandbox success does not automatically enable Production. Complete this checklist with the people responsible for the integration, security, privacy, compliance, and operations.

## Configuration

* [ ] Production API, hosted, and dashboard origins are explicit.
* [ ] Sandbox keys, tokens, flow IDs, and webhook secrets have been removed.
* [ ] The Production API key and webhook secret are stored in a secret manager.
* [ ] Public SDK keys are used only in approved clients.
* [ ] Web domains, iOS bundle IDs, and Android package IDs are approved.
* [ ] Production flow IDs and versions are recorded.
* [ ] The webhook endpoint verifies raw bytes and signatures, deduplicates delivery IDs, and returns a fast `2xx`.

## Test matrix

* [ ] Success, pending, review, and rejection paths.
* [ ] Cancellation, expiry, invalid input, denied permission, and unsupported documents.
* [ ] Maximum-attempt and support recovery.
* [ ] Duplicate, delayed, out-of-order, replayed, and invalid-signature webhooks.
* [ ] `400`, `401`, `404`, `429`, timeout, and `5xx` handling.
* [ ] Every supported browser, device, OS, SDK version, and locale.
* [ ] Unknown statuses enter a safe review state.

## Operations

* [ ] Correlation IDs, resource IDs, event IDs, versions, latency, and outcomes are monitored without logging secrets or sensitive payloads.
* [ ] Alert thresholds and escalation contacts are documented.
* [ ] Data retention, deletion, and reviewer-access policies are configured.
* [ ] Rate expectations and retry bounds are agreed.

## Rollout and rollback

* [ ] Begin with an approved cohort and measurable guardrails.
* [ ] Keep the previous application or flow version available during rollout.
* [ ] Stop new journey starts on contract, security, privacy, or webhook-delivery failures.
* [ ] Preserve in-progress session and case evidence during rollback.
* [ ] Reconcile affected records before restarting the rollout.