Going to production

Run through this before a live church depends on your code.

Keys#

• [ ] Each integration has its own key with only the scopes it needs. See authentication.
• [ ] Keys live in your secret store, not in source control, a web page or an app.
• [ ] Keys have an expires_at and an ip_allowlist where you can.
• [ ] You have rehearsed rotating a key: create the replacement, deploy it, retire the old one inside the grace period.
• [ ] The key's last-used time is monitored, so you notice a leaked key.

Requests#

• [ ] Every write sends an Idempotency-Key derived from the thing being done. See idempotency.
• [ ] You retry 429, 500 and 503 with backoff and respect Retry-After. See rate limits.
• [ ] You do not retry 4xx errors unchanged. See errors.
• [ ] You log error.request_id with every failure so support can find it.
• [ ] You page lists until has_next is false. See pagination.
• [ ] You ignore fields and enum values you do not know.

Webhooks#

• [ ] You verify the signature on the raw body and reject old timestamps. See webhooks.
• [ ] You answer 2xx quickly and do the work after.
• [ ] You deduplicate on the event id (evt_…).
• [ ] Your handlers tolerate out-of-order deliveries.
• [ ] You alert when your endpoint is disabled, and you know how to replay.

Money and limits#

• [ ] You handle 402 quota_exceeded and 402 ai_budget_exhausted in your user interface, not as a crash.
• [ ] You read plan prices from GET /v1/public/plans, never from a copy.
• [ ] Partners: you watch partner.church.usage_threshold events.

Content#

• [ ] You show only published content, and say whether a note was approved by a person or automatically.
• [ ] You show an answer's sources and its standing.
• [ ] You use the King James Version attribution where you display scripture.
• [ ] You cope with not_covered answers as a normal result.

Status#

Subscribe to the status page via GET /v1/status, and note the API version you built against. The changelog lists what changes and when.