> For the complete documentation index, see [llms.txt](https://docs.blitzware.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blitzware.xyz/developers/production-deployment-checklist.md).

# Production Deployment Checklist

Review authentication configuration before launching BlitzWare in production.

Use this checklist before enabling production authentication traffic.

## Application configuration

* [ ] Production uses a separate Application from staging and local development.
* [ ] OAuth Redirect URIs match production domains exactly.
* [ ] Basic Application IDs and API Keys come from production configuration.
* [ ] Developer or test-only modes are disabled.
* [ ] Token lifetimes match your risk profile.

## Secrets and credentials

* [ ] API Keys are stored in a secret manager or protected runtime config.
* [ ] API Keys are scoped to minimum required permissions.
* [ ] No Tokens, API Keys, reset tokens, or MFA codes are logged.
* [ ] Rotation and revocation steps are documented.

## User and identity

* [ ] Hosted User Store or Database Connection mode is selected intentionally.
* [ ] Password reset is tested.
* [ ] Email verification behavior is tested.
* [ ] MFA setup, login, and recovery are tested where enabled.

## Operations

* [ ] Logs and security events are monitored.
* [ ] Rate limit handling is implemented.
* [ ] Session or Token revocation is tested.
* [ ] Account deletion and recovery procedures are documented.
* [ ] OAuth Application collaborators and pending invitations were reviewed.

Related pages: [Testing Authentication Flows](/developers/testing-authentication-flows.md), [Logs and Audit Trails](/operations/logs-and-audit-trails.md), [OAuth Application Collaboration](/applications/oauth-application-collaboration.md), and [Backup and Recovery Concepts](/operations/backup-and-recovery-concepts.md).