Production checklist

Keys

• Live key in a server secret store, never in client code, a mobile app or git.
• Narrowest scopes: a key that only sends and verifies needs send + verify.
• An expiry and a rotation plan. Revoking is instant.

Flow

• The verification token and the widget session_id stay server-side.
• Mark users verified only after check() succeeds or redeem() matches your session_id and client_reference.
• Rate-limit your own "send code" endpoint per user and IP too — it costs money.
• Never log codes, tokens, proofs or keys. Log the trace_id.

Widget

• Only your production origins in the allowlist.
• frame-src https://verifyme.cubis.tech in your CSP.
• Handle session_expired by creating a new session.
• Optional: pin the loader with version + integrity.

Delivery

• A live profile for every channel you use, and a default for each.
• A second provider and a routing rule for failover.
• Send limits by prefix or country to cap SMS-pumping fraud.
• Templates reviewed for every channel (brand name, code lifetime).

Operations

• Webhook handler verifies the signature and deduplicates on X-Verifyme-Delivery.
• Retries honour Retry-After and back off on 5xx.