Go-live checklist
Verify security, correctness, moderation, and operations before production traffic.
Security
- API keys and signing private keys are stored only in a production secret manager.
- Logs redact Authorization headers, link IDs, JWT/JWE values, and personal data.
- Redirect destinations are internal paths selected by your server.
- Passwords are never collected for or sent to Genesis.
- Credential rotation and incident contacts are documented.
Account linking
- Accept and decline work.
- Existing password and OAuth accounts return to the flow correctly.
- New accounts verify email and finish linking.
- Expired, replayed, tampered, and wrong-partner tokens fail.
- Email mismatch and identity conflict errors are handled.
- Automatic navigation and the manual continue/close action both work.
Operations
- Genesis has approved the production domain, capabilities, traffic, and moderation approach.
- Your retries use bounded exponential backoff and stable idempotency keys.
- Alerts distinguish authentication, permission, validation, rate-limit, and server failures.
- Support can provide non-secret diagnostics.
- A rollback can disable delivery without deleting user accounts or unrelated Forum data.
Comment ingestion
201; identical retries return200andcreated: false.