Production checklist

Keys & secrets

• Production API keys are stored in a secret manager — never in source control or client code.
• Separate keys per environment and per integration; each scoped to only the token configs it needs.
• A documented rotation procedure exists, with an owner.

Verification flow

• You request the correct schema for each asset's requirements.
• Your UI handles every status: pending, verified, rejected, expired.
• Wallet addresses are validated client-side before calling the API.
• You re-check expires_at rather than caching an “eligible” flag.

Compliance rules

• Each token config has a reviewed rule set (schema, jurisdictions, minimum, holder cap, lock).
• Dashboard access is restricted to compliance staff.
• You verified a rule change end-to-end against a known wallet and confirmed the audit-log entry.

Token operations

• All three 403 reasons are handled explicitly: attestation_required, attestation_expired, rule_violation.
• Unsigned transactions are signed in the user's wallet, submitted, and confirmed before you update records.
• You never assume eligibility — the API performs the check at build time.

Resilience & monitoring

• You log request_id from API responses for support and tracing.
• You handle 429 (quota) and back off rather than hammering the API.
• You monitor usage against your plan quota and alert before you hit it.
• You have a runbook for KYC-provider or RPC degradation.