> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kynasmith.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Production checklist

> Steps to verify before deploying your Kynasmith integration to production.

# Production checklist

Use this checklist before deploying your Kynasmith integration to production.

## Authentication

* [ ] API keys are stored in a secrets manager or environment variables, not in source code.
* [ ] Browser integrations use a backend `tokenProvider` endpoint, not embedded API keys.
* [ ] Access tokens are minted with the narrowest scopes needed for each use case.
* [ ] Token refresh is handled automatically (SDK-managed) or explicitly (custom integration).

## MoveSpec

* [ ] Your production MoveSpec has a released immutable version.
* [ ] You have validated the draft YAML and resolved all errors before releasing.
* [ ] If using `movespec_id` resolution, you understand that releasing a new version will affect all future sessions.
* [ ] If using `movespec_version_id`, you have pinned to a specific version for deterministic behavior.

## Detection sessions

* [ ] Sessions are finalized when processing is complete.
* [ ] Failed or abandoned sessions are cancelled to free resources.
* [ ] Your integration handles `session_done` with both success and failure outcomes.
* [ ] If using manual session control, your reconnect logic reuses the original session credentials.

## Error handling

* [ ] Your integration handles `AuthError` (401) with token refresh or re-authentication.
* [ ] Your integration handles `RateLimitError` (429) with exponential backoff. See [Rate limits](/api-reference/rate-limits).
* [ ] Your integration handles billing errors (403 `quota_exceeded`) gracefully. See [Billing](/billing/overview).
* [ ] You log `X-Request-ID` from error responses for support escalation.

## Browser integrations

* [ ] Your CSP and network configuration allow connections to `api.kynasmith.dev`.
* [ ] Your CSP allows MediaPipe WASM and model asset downloads (Google Cloud Storage, jsDelivr).
* [ ] Camera helpers have `navigator.mediaDevices.getUserMedia()` permission.
* [ ] Your backend token endpoint is reachable from your frontend origin.

## SDK compatibility

* [ ] You are using a supported SDK version. Check the [changelog](/production/changelog) for the latest release.
* [ ] Your `mediapipe` / `@mediapipe/tasks-vision` version matches the tested compatibility line.
* [ ] You are not using a custom model asset without re-running replay conformance.

## Monitoring

* [ ] You monitor accepted-frame usage to avoid unexpected quota exhaustion.
* [ ] You have alerting on elevated 4xx/5xx error rates.
* [ ] You log session results (`accepted_frames_total`, `completed_event_counts`) for debugging.