# Go-live checklist (/en/docs/developers/agent/embed/go-live)



Use this checklist before first launch or after changing domains, identity integration or component versions. Complete [Test your embed](/en/docs/developers/agent/embed/testing), save verifiable results for each item, then open access.

## Confirm launch requirements [#checklist]

* [ ] **Configuration and versions match.** Dashboard **Integration and configuration → Versions** shows the intended embed version. A newly issued token creates a session with that version. Check that an explicit issuance `version` does not override your selection.
* [ ] **Identity comes from host authentication.** Logged-out requests cannot obtain tokens from your host. Test users A and B cannot see each other's sessions. The API Key stays on the server; browser source and responses contain no real `PRAXIS_API_KEY` value.
* [ ] **Anonymous credentials are handled correctly.** If enabled, expose only the publishable key and configure its limits. Visitors with separate browser storage remain isolated. Do not share `visitor_secret`.
* [ ] **Target origins work.** Complete a conversation on the actual HTTPS domain; an unlisted origin fails. The iframe renders in its intended page. Hosted opens independently and cannot be framed. Disable localhost access when no longer needed.
* [ ] **Component delivery is reproducible.** Record and verify the Kit version, script URL and applicable integrity value. Load from an empty cache and receive a real reply, not just `praxis.ready`.
* [ ] **Refusal paths recover correctly.** Test expiry, revocation, blocking and origin refusal. Destroy the old component on host logout. After Hosted expiry, obtain a new link rather than looping over an invalid one.
* [ ] **Tools enforce permissions.** Test valid input, invalid input and users without business permissions. Confirmation on every call does not replace server-side authorization.
* [ ] **Budgets and monitoring work.** Verify US-dollar budgets, lifetime, request limits and active-session limits. Confirm the monthly cap action. Find the host test session, source and spending under Operations.

## Prepare rollback and support [#rollback]

Keep a verified host deployment and component version. For configuration issues, select an older version and click **Roll back to this version (回滚到此版本)**. Verify after issuing a new token; existing tokens do not change. To stop a specific user's access immediately, [block or revoke all tokens](/en/docs/developers/agent/end-users) and confirm old-token access fails.

For support, retain the time, environment, public agent ID, session ID, HTTP status, error code and `X-Request-Id`. Exclude tokens and API Keys. Follow the recovery action in [Limits and errors](/en/docs/developers/agent/embed/limits-and-errors), then verify a conversation from the host.

Related: [Configure your agent](/en/docs/developers/agent/configure) · [Component reference](/en/docs/developers/agent/embed/component-reference) · [Agent API](/en/docs/api/native/agent)