Go-live checklist

Use this checklist before first launch or after changing domains, identity integration or component versions. Complete Test your embed, save verifiable results for each item, then open access.

Confirm launch requirements

• Configuration and versions match. Dashboard Integration and configuration → Versions shows the intended embed version. A newly issued token creates a session with that version. Check that an explicit issuance version does not override your selection.
• Identity comes from host authentication. Logged-out requests cannot obtain tokens from your host. Test users A and B cannot see each other's sessions. The API Key stays on the server; browser source and responses contain no real PRAXIS_API_KEY value.
• Anonymous credentials are handled correctly. If enabled, expose only the publishable key and configure its limits. Visitors with separate browser storage remain isolated. Do not share visitor_secret.
• Target origins work. Complete a conversation on the actual HTTPS domain; an unlisted origin fails. The iframe renders in its intended page. Hosted opens independently and cannot be framed. Disable localhost access when no longer needed.
• Component delivery is reproducible. Record and verify the Kit version, script URL and applicable integrity value. Load from an empty cache and receive a real reply, not just praxis.ready.
• Refusal paths recover correctly. Test expiry, revocation, blocking and origin refusal. Destroy the old component on host logout. After Hosted expiry, obtain a new link rather than looping over an invalid one.
• Tools enforce permissions. Test valid input, invalid input and users without business permissions. Confirmation on every call does not replace server-side authorization.
• Budgets and monitoring work. Verify US-dollar budgets, lifetime, request limits and active-session limits. Confirm the monthly cap action. Find the host test session, source and spending under Operations.

Prepare rollback and support

Keep a verified host deployment and component version. For configuration issues, select an older version and click Roll back to this version (回滚到此版本). Verify after issuing a new token; existing tokens do not change. To stop a specific user's access immediately, block or revoke all tokens and confirm old-token access fails.

For support, retain the time, environment, public agent ID, session ID, HTTP status, error code and X-Request-Id. Exclude tokens and API Keys. Follow the recovery action in Limits and errors, then verify a conversation from the host.

Related: Configure your agent · Component reference · Agent API