Production checklist

Authentication & credentialsCopy Anchor Link

• The API key lives only on your backend — grep your built frontend bundle to make sure it never ended up in JavaScript shipped to the browser.
• If you use a signed identity (user-hash), identity_secret stays on the backend only, expires_at is never more than 24 hours from when you sign it, and you re-sign on every page render (don't cache a signature longer than necessary).
• Allowed origins (Console → Integration) lists your actual production domain — not localhost. Check both www. and bare, if your site serves both.
• If you use token-url, that endpoint authenticates the caller itself (a session cookie, or equivalent) before calling POST /v2/token — it isn't an open proxy anyone can call.

Error handlingCopy Anchor Link

• Program against code, not message (see Errors) — message can change without notice.
• Handle rate_limited by waiting retry_after seconds before retrying, not retrying immediately.
• Handle budget_exceeded with a clear message to the end-user ("service is temporarily at capacity") instead of a generic error.
• redis_unavailable on the stream endpoint doesn't mean the answer was lost — poll the conversation instead, don't surface it as a user-facing error.

StreamingCopy Anchor Link

• Handle a dropped connection mid-run: call GET /v2/runs/{run_id}/stream again, don't resend the message.
• Ignore any SSE line starting with : (the keepalive comment) instead of treating it as a parse error.
• Don't use the browser's native EventSource if you need the Authorization header — see Streaming.

Limits & idempotencyCopy Anchor Link

• Send Idempotency-Key on every message-sending call, especially if your client can auto-retry on timeout.
• The cap of 3 concurrent runs per end-user isn't a bug — if your UI lets someone send messages in quick succession, disable input while waiting for the previous run to finish, or handle scope: "active_runs" explicitly.

OperationsCopy Anchor Link

• Review Usage & Quotas in the console before launch — set a sensible daily token budget for the org/agent if you want a hard cost ceiling.
• Know how to read Runs & traces in the console to debug a bad answer — every tool call and citation is reviewable.
• Have a plan for blocking or deleting an end-user (Console → Conversations & End-users) if your product needs it (spam, data deletion requests).