Going to production - onlyfanskit

Use this checklist before you point production creators at your app.

Environments

Separate API keys

Create distinct keys (and webhook endpoints) for staging and production. Scope staging keys narrowly.

Validate connect flows

Exercise every connect path you support — embedded, login, and mobile — against a test account in staging.

Smoke-test core actions

Run the guides you depend on: at minimum one read and one write per domain (messages, fans, content, or earnings).

Register webhooks or subscribe to SSE in staging first; confirm signature verification and idempotent handlers.
Plan reconnect behavior for WebSocket clients.

Implement backoff on 429 using Retry-After — see Rate limiting.
Parse RFC 9457 errors; branch on retryable and stable code values for agent automation.
Monitor error rates and quota headers; alert before hard limits block users.

Complete the Security practices: no keys in clients, no credential logging, least-privilege scopes.