> ## Documentation Index
> Fetch the complete documentation index at: https://docs.framelane.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Production Checklist

> Before going live, verify these items.

## Authentication

* [ ] API key is stored in a secret manager, not in source code
* [ ] Key rotation procedure is documented and tested
* [ ] Old keys are revoked after rotation

## Idempotency

* [ ] Every `POST /v1/renders` and `POST /v1/tasks/*` call includes an `Idempotency-Key` header
* [ ] Idempotency keys are unique per logical operation (e.g. UUID tied to your internal job ID)
* [ ] Retry logic checks for `200` (replay) vs `202` (new job)

## Webhooks

* [ ] Webhook endpoint is HTTPS with a valid certificate
* [ ] HMAC signature verification is implemented (see [Signature Verification](/webhooks/signature-verification))
* [ ] Webhook handler returns `200` within 10 seconds to avoid retry storms
* [ ] Dead-letter events are monitored and alerted on

## Error handling

* [ ] `429` responses are retried with exponential backoff
* [ ] `failed` job status triggers your own alerting
* [ ] `source_not_found` / `invalid_source` errors surface meaningful messages to your users

## Observability

* [ ] All Framelane job IDs are logged alongside your internal IDs
* [ ] Webhook delivery failures are tracked
* [ ] Monthly quota usage is monitored (alert before hitting limits)

## Source URLs

* [ ] All `source_url` values are publicly accessible HTTPS URLs
* [ ] Source files are under 5 GiB
* [ ] Source URLs remain valid for at least 1 hour after job submission (the render engine fetches them asynchronously)