Developer Platform

Integration go-live checklist

A practical review for credentials, scopes, retries, webhooks, observability, test isolation, and operational ownership.

Use this checklist before an integration handles customer data or performs production mutations. Passing a happy-path request is not enough.

Identity and secrets

• Create a dedicated API client for the integration and environment.
• Remove scopes that the exercised operation inventory does not require.
• Store credentials and connector secret references in an approved secret manager.
• Document rotation and emergency revocation, then test both.
• Verify the returned auth context matches the intended SaaS app during startup.

Requests and recovery

• Bound timeouts, concurrency, pages, and retry attempts.
• Retry only safe or idempotent operations and honor Retry-After.
• Test duplicate webhook delivery, out-of-order events, stale signatures, and dead-letter retry.
• Handle 401, 403/safe 404, 409, 422, 429, and 5xx deliberately.
• Use documented status, retry, recovery, and correlation workflows during an outage.

Compatibility and observability

• Validate examples/SDK calls against the current OpenAPI operation IDs.
• Generate and review a database contract lock if the integration relies on application schema shape.
• Log operation, duration, status, app ID, and correlation ID without secrets or raw sensitive bodies.
• Create alerts for sustained authentication failures, rate limiting, webhook dead letters, and failed async jobs.
• Name a human owner and escalation path for each integration, inbound endpoint, webhook subscription, and connector.

Environment proof

Exercise the exact production origin and credential only through an approved deployment check. A successful local or staging contract test does not prove DNS, certificates, rate configuration, external callbacks, or production secret delivery.