Go-live checklist

Keys and configuration

• Create live keys (pk_live_…, sk_live_…) and keep the test keys for staging.
• The secret key lives in your production secret store, not in code, images or logs.
• The secret key’s scopes are no wider than the job (security); add an IP allow-list for your servers.
• The publishable key’s allowed origins and the workspace’s embed domains list exactly your production origins, with https.

Token endpoint

• It checks your own session and answers 401 when nobody is signed in.
• It answers 403 to signed-in users who are not your staff: customers who signed up never get a token.
• It returns a new token on every call, with Cache-Control: no-store.
• Each production user maps to the right member (email verified the first time); nobody signs in as the owner.
• Your server clock is synchronised (NTP): tokens may live 10 minutes at most.

Pages

• Your Content-Security-Policy allows https://app.nexafone.so/embed scripts and https://app.nexafone.so frames.
• Nexafon.init runs once per page; Nexafon.destroy() runs on sign-out.
• Your appearance (colour, mode, font) looks right in light and dark mode.
• Multi-page sites use popOutCalls: true, and you tested a call across a navigation.
• You handle session.error (show your own message, log the code).

Webhooks

• Endpoints are https and answer 2xx within 10 seconds, queuing slow work.
• Signatures are verified on the raw body; deliveries are deduped on id.
• Someone receives the “webhook turned off” email, and you know how to replay events.

WhatsApp and calls

• The WhatsApp number is connected and approved; calling is turned on if you use calls.
• Templates you send outside the 24-hour window are approved.
• The wallet has credit, and someone gets the low-balance notice (or auto top-up is on).

Commerce (if you sell in WhatsApp)

• Products sync from your platform, and rejected items are handled (catalog.product_status).
• The store’s PayPoint key is saved and tested, and its wallets are chosen.
• Delivery areas, fees and Shop opening hours are set; order webhooks reach your platform.

Before you call it done

• Errors are handled by code, not detail, and 429 waits for Retry-After.
• You ran the quickstart flow end to end with live keys on a staging copy of your site.