The going-live checklist
Everything to verify before flipping a platform (or a site) to production.
Updated
On this page
Platform go-live
- Origins first. Every public key has its allowed origins configured — the live flip is refused otherwise, by design.
- Keys placed correctly. Live secret key in the server env only; no secret in any
NEXT_PUBLIC_*; test keys removed from production configs. - Modules match reality. The grant list is exactly what the front end expects — extra grants are surface you aren't watching; missing grants are 404s your users will find first.
- MFA on. Enable forced email MFA for staff before real data arrives, not after.