> For the complete documentation index, see [llms.txt](https://dnotifier.gitbook.io/product-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dnotifier.gitbook.io/product-docs/operations/production-checklist.md).

# Production checklist

Use this checklist before launching a DNotifier integration to production. It covers credentials, transport choice, limits, observability, and operational readiness.

***

## Account and application

| Step | Action                                                                         | Done |
| ---- | ------------------------------------------------------------------------------ | ---- |
| ☐    | Production DNotifier account at [app.dnotifier.com](https://app.dnotifier.com) |      |
| ☐    | Production app created with **rotated secret** (not the dev secret)            |      |
| ☐    | Plan limits reviewed — messages, AI, knowledge base, users                     |      |
| ☐    | `userId` scheme documented (how IDs map to users, devices, bots)               |      |

→ [Create an app](/product-docs/getting-started/create-app.md) · [Pricing & plans](/product-docs/platform-overview/pricing.md)

***

## Credentials and secrets

| Step | Action                                                                       | Done |
| ---- | ---------------------------------------------------------------------------- | ---- |
| ☐    | Secrets stored in environment variables or a secret manager — **not** in git |      |
| ☐    | `.env` and secret files in `.gitignore`                                      |      |
| ☐    | Browser / mobile builds do **not** embed production secrets                  |      |
| ☐    | Secret rotation procedure documented                                         |      |

→ [Credentials & environment](/product-docs/getting-started/credentials.md) · [Security best practices](/product-docs/operations/security.md)

***

## Transport architecture

| Step | Action                                                        | Done |
| ---- | ------------------------------------------------------------- | ---- |
| ☐    | `transport: "ws"` for realtime chat and live delivery         |      |
| ☐    | `transport: "http"` for AI, RAG, workflows, and serverless    |      |
| ☐    | Node.js WebSocket clients pass `WebSocketImpl` (`ws` package) |      |
| ☐    | Reconnection strategy implemented for `onDisconnected`        |      |

→ [Choose your transport](/product-docs/getting-started/choose-transport.md)

***

## Messaging and data

| Step | Action                                                                           | Done |
| ---- | -------------------------------------------------------------------------------- | ---- |
| ☐    | `senderId` and `receiverId` / `receiverIds` validated server-side where possible |      |
| ☐    | `saveHistory` behavior defined per message type                                  |      |
| ☐    | Large payloads tested against `messageSizeLimit` from plan                       |      |
| ☐    | Chunked message handling verified in `onMessage`                                 |      |

→ [Plan limits & quotas](/product-docs/realtime-communication/plan-limits.md) · [Large messages & chunking](/product-docs/realtime-communication/chunking.md)

***

## AI and knowledge base (if used)

| Step | Action                                                               | Done |
| ---- | -------------------------------------------------------------------- | ---- |
| ☐    | `aiEnabled` checked after `connect()` before calling `sendAI`        |      |
| ☐    | Monthly AI request and word limits understood                        |      |
| ☐    | Knowledge-base document size within plan word caps                   |      |
| ☐    | `logs: true` enabled only when dashboard session tracking is desired |      |

→ [AI overview](/product-docs/ai/overview.md)

***

## Workflows (if used)

| Step | Action                                                      | Done |
| ---- | ----------------------------------------------------------- | ---- |
| ☐    | Agents registered before `runWorkflow`                      |      |
| ☐    | `observability: true` for production debugging in dashboard |      |
| ☐    | Workflow errors caught and surfaced to callers              |      |
| ☐    | Long-running workflows tested for timeout behavior          |      |

→ [Workflows overview](/product-docs/workflows-and-agents/overview.md)

***

## Error handling and resilience

| Step | Action                                                          | Done |
| ---- | --------------------------------------------------------------- | ---- |
| ☐    | `connect()` failures handled with user-visible or logged errors |      |
| ☐    | Auth 400 responses diagnosed (wrong secret, invalid app)        |      |
| ☐    | Graceful `disconnect()` on process shutdown                     |      |
| ☐    | Idempotent reconnect (no duplicate listeners)                   |      |

→ [Error handling & reconnection](/product-docs/realtime-communication/error-handling.md) · [Troubleshooting](/product-docs/operations/troubleshooting.md)

***

## Monitoring and operations

| Step | Action                                                                                  | Done |
| ---- | --------------------------------------------------------------------------------------- | ---- |
| ☐    | Connection state exposed in UI or health checks                                         |      |
| ☐    | Structured logging for connect, disconnect, send failures                               |      |
| ☐    | Dashboard reviewed for AI sessions and workflow executions                              |      |
| ☐    | On-call runbook links to [Troubleshooting](/product-docs/operations/troubleshooting.md) |      |

→ [Debugging](/product-docs/operations/debugging.md)

***

## Security review

| Step | Action                                                          | Done |
| ---- | --------------------------------------------------------------- | ---- |
| ☐    | Least-privilege: each service uses its own `userId`             |      |
| ☐    | Input validation on message payloads before display (XSS)       |      |
| ☐    | TLS only — no custom endpoints over plain `ws://` in production |      |
| ☐    | Rate limiting on your API layer if clients proxy through you    |      |

→ [Security best practices](/product-docs/operations/security.md)

***

## Pre-launch smoke test

Run this sequence in a staging environment:

1. `connect()` with production credentials → `onConnected` fires
2. `getPlanLimits()` returns expected caps
3. Send text message A → B → received in `onMessage`
4. (If AI) `sendAI` returns a response when `aiEnabled` is true
5. (If workflows) `runWorkflow` completes with `executionId`
6. `disconnect()` cleans up without errors

{% hint style="success" %}
When all items are checked, your integration is ready for production traffic. Keep this checklist updated as you add AI, chat history, or workflow features.
{% endhint %}

***

## Related guides

* [Developer integration guide](/product-docs/platform-overview/developer-integration-guide.md)
* [Performance & limits](/product-docs/operations/performance.md)
* [FAQ](/product-docs/operations/faq.md)