Go-Live Checklist (Test → Production)

The path from first test call to production traffic.

1 — Build against test modelink

• Create a sk_test_… key (Dashboard → Org → API Keys) with only the scopes you need.
• Everything in this collection works identically in test mode, on the same base URL. Test keys live in a physically separate keyspace — they can never touch live data.
• Run End-to-End with your test key until every step is green.

2 — Pre-production checklistlink

• Scopes minimised — ingest keys have ingest:write only; CI keys have symbols:upload + deploy:write only; runtime secret fetch has secret-read only. Nothing ships with full-access.
• No secret key in any client — browsers use the session mint flow; mobile apps use projectId + mobileAppSecret; chat clients use the bare widget key ID.
• Browser origins locked — the BugWatch project's allowed-origins list contains exactly your production origins (empty = any origin can spend your quota).
• Symbols in CI — every release build uploads its mapping/source map/dSYM before rollout (Source Maps & Symbols).
• Deploy tracking wired — deploy start/run/finish in the pipeline (Deployments) so failed deploys open issues.
• Webhook receivers verified — signature verification implemented (Webhooks), HTTPS, responding < 5 s.
• Error handling — your integration honours Retry-After on 429, retries 5xx with backoff, and sets eventId so retries dedupe.
• Secrets stored safely — API keys in your secret store (or New Instance Secret Manager), never in code or client bundles.

3 — Go livelink

1. Create the sk_live_… key(s) with the same minimal scopes. The secret is shown once.
2. Swap the key in your deployment configuration (not in code).
3. Re-run End-to-End once against live (it creates one test ticket and one test event — both harmless and deletable).
4. Watch the first hour: BugWatch project → live tail for ingest, Deployments tab for the release, ticket list for support flow.

4 — Operatelink

• Rotation: Dashboard → API Keys → Regenerate secret invalidates the old secret immediately (caches clear within seconds on the REST API). Rotate on any suspicion of exposure and on your normal credential cadence.
• Revocation: Revoke disables the key immediately. BugWatch project deletion also revokes every DSN key bound to it.
• Monitoring your usage: 429s mean you're hitting the 100 req/min org limit on business endpoints — batch harder or split workloads across orgs/products.
• Incident path: capture the X-Correlation-ID of a failing request, then contact support with it and your org slug.