Production checklist

Checklist for promoting a tested VOVE ID integration to Production.

Sandbox success does not automatically enable Production. Complete this checklist with the people responsible for the integration, security, privacy, compliance, and operations.

Configuration

• Production API, hosted, and dashboard origins are explicit.

• Sandbox keys, tokens, flow IDs, and webhook secrets have been removed.

• The Production API key and webhook secret are stored in a secret manager.

• Public SDK keys are used only in approved clients.

• Web domains, iOS bundle IDs, and Android package IDs are approved.

• Production flow IDs and versions are recorded.

• The webhook endpoint verifies raw bytes and signatures, deduplicates delivery IDs, and returns a fast 2xx.

Test matrix

• Success, pending, review, and rejection paths.

• Cancellation, expiry, invalid input, denied permission, and unsupported documents.

• Maximum-attempt and support recovery.

• Duplicate, delayed, out-of-order, replayed, and invalid-signature webhooks.

• 400, 401, 404, 429, timeout, and 5xx handling.

• Every supported browser, device, OS, SDK version, and locale.

• Unknown statuses enter a safe review state.

Operations

• Correlation IDs, resource IDs, event IDs, versions, latency, and outcomes are monitored without logging secrets or sensitive payloads.

• Alert thresholds and escalation contacts are documented.

• Data retention, deletion, and reviewer-access policies are configured.

• Rate expectations and retry bounds are agreed.

Rollout and rollback

• Begin with an approved cohort and measurable guardrails.

• Keep the previous application or flow version available during rollout.

• Stop new journey starts on contract, security, privacy, or webhook-delivery failures.

• Preserve in-progress session and case evidence during rollback.

• Reconcile affected records before restarting the rollout.