# Production checklist

> Hardening checklist for auth, retries, quotas, webhook handling, and support readiness.

You've built your integration. Run through this checklist to make sure everything is production-ready.

## Before go-live

- Store API keys server-side or in a secure secrets manager. See [Authentication](https://docs.reversecontact.com/authentication#keep-your-key-safe).
- Log `metadata.requestId` for every request so support can trace issues quickly.
- Monitor `quotas.workspace.credits.left` and `quotas.workspace.minuteRateLimit.left` from the [Usage endpoint](https://docs.reversecontact.com/endpoints/usage).
- Route async workflows through a durable [webhook receiver](https://docs.reversecontact.com/guides/webhooks#2-set-up-a-receiver), not a manual test endpoint.
- Make webhook processing idempotent by deduplicating on `webhookId`. See [Webhooks](https://docs.reversecontact.com/guides/webhooks#security-best-practices).

## Request safety

- Use timeouts on every outbound request.
- Retry only `429` and `5xx` with exponential backoff. See [Error handling](https://docs.reversecontact.com/guides/errors-retries#when-to-retry).
- Respect `minuteRateLimit.nextReset` before retrying a throttled request.
- Treat `4xx` validation or auth failures as permanent until you change the input or credentials.

## Webhook safety

- Use HTTPS for every production webhook URL.
- Return `200` quickly, then process heavy work asynchronously.
- Validate that each callback contains `webhookId` + `data` or `webhookId` + `errorCode`. See [Webhook payload](https://docs.reversecontact.com/guides/webhooks#webhook-payload).
- Deduplicate on `webhookId` to handle rare duplicate deliveries.

## Monitoring & alerts

- Alert on repeated `401`, `402`, `429`, and `5xx` responses.
- Surface credit exhaustion before it blocks critical workflows. See [Rate limits & credits](https://docs.reversecontact.com/guides/rate-limits-credits).
- Keep one smoke test for a sync endpoint and one for an async endpoint (see below).
- Document which team owns [API key rotation](https://docs.reversecontact.com/guides/api-key-management), webhook incidents, and quota alerts.

## Recommended smoke tests

1. `GET /v2/usage` returns `200` and a valid `quotas` object.
2. `POST /v2/fetch/persons/check` returns `200` with `creditsConsumed: 0`.
3. One async endpoint returns an immediate response and the result is delivered to your webhook URL.
4. Your application logs both the outbound request and the webhook completion using the same `requestId` or `webhookId`.

## You're ready to go live

If you've checked every item above, your integration is solid. Ship it.