Test and go live

Ask for a test integration

Genesis runs one Forum environment. Rather than a separate sandbox host, ask Genesis for a test integration: its own slug (such as yourplatform-test), its own API key, only the capabilities you are exercising, and a low rate limit. Content it creates can be removed on request without touching your production integration.

Use test accounts, mailboxes you control, and clearly labelled test content. Never point a test run at your production API key. Ingested comments land in a real, publicly visible discussion, so keep the volume low and tell Genesis which novel you used.

What to test

Account linking: request a link via POST /api/integrations/link, open the returned url in a private browser window, and exercise decline, existing password sign-in, existing OAuth sign-in, and new-account creation with separate UUIDs and idempotency keys. For signed links, also test expired exp, wrong aud, unknown kid, changed ciphertext, and duplicate jti.

Comment ingestion: deliver a comment via POST /api/integrations/posts, then repeat the exact request to verify created: false. Test an omitted timestamp, a reply via parent_uuid, a missing novel without creation capability, a disabled capability, an invalid key, oversized fields, and rate limiting.

Novels: upsert via POST /api/integrations/novels and verify a replay updates rather than duplicates.

Go-live checklist

• API keys and signing private keys live only in a production secret manager; logs redact Authorization headers, link IDs, token values, and personal data.
• Accept, decline, existing-account, OAuth, and new-account linking flows all complete; tampered or replayed tokens fail.
• New comments return 201; identical retries return 200 with created: false; replies attach; attribution displays correctly before and after linking.
• Retries use bounded exponential backoff with stable idempotency keys, and alerts distinguish authentication, validation, rate-limit, and server failures.
• Genesis has approved the production domain, capabilities, traffic, and moderation approach, and a rollback can disable delivery without deleting accounts or Forum data.

Credential rotation

To rotate an API key, email info@genesistudio.com; Genesis issues the new key to your technical contact and the old key stops working at that moment, so deploy the swap as one coordinated change and verify with a low-risk request.

To rotate a signing key, generate a new keypair, send Genesis the public JWK with a new kid, and coordinate the activation time. Never reuse a kid for different key material.

For suspected compromise, disable the integration or capability first, rotate, examine idempotency keys and audit events, and re-enable only after verification.