# Production Readiness Checklist

> A concise launch checklist for keys, auth, timeouts, retries, caching, dates, quotas, plan gates, logging, and failure drills.

Canonical: https://currency-core.com/docs/guides/production-checklist/
Updated: 2026-11-11
Published: 2026-11-11

---
Run this with the production key and configuration, not a mock. There is no published uptime commitment to cite, so the final step is a failure drill. Name an owner for the key, quota alert, and rollback first.

## Access

- [ ] Store keys server-side, never in client bundles or git. [Authentication](/docs/authentication/)
- [ ] Use one key per environment, with test keys outside production. Revocation clears within 5 minutes. [Security](/docs/guides/security/)
- [ ] Send `Authorization: Bearer` or `x-api-key`; never put a key in a query string. [Authentication](/docs/authentication/)

## Requests

- [ ] Set a timeout on every call, shorter than the caller's own budget. [Errors](/docs/errors/)
- [ ] Retry only `429` and `5xx`, honor `Retry-After`, and cap attempts. [Retries](/docs/guides/retries/)
- [ ] Cache by base and date; cache past dates with a long TTL and keep the observation date. [Caching](/docs/guides/caching/)
- [ ] Send dates as `YYYY-MM-DD` in UTC and read `requestedDate` and `asOf`. [History coverage](/docs/guides/history-coverage/)

## Budget

- [ ] Alert on the monthly organization quota and the per-key minute limit separately. The minute limit counts errors and retries; the monthly quota counts successful billable requests. The API sends no quota headers, so measure from your side. [Rate limits](/docs/rate-limits/)
- [ ] Map the gates: Free history is 30 days, analytics need Growth, AI credits are separate. [Rate limits](/docs/rate-limits/)

## Behavior

- [ ] Switch on `error.code`; `402 billing_past_due`, `403 forbidden`, and `429 rate_limited` are different outcomes. [Errors](/docs/errors/)
- [ ] Log a correlation ID you generate, plus status, code, and latency. Never log the key; the API returns no request ID. [Observability](/docs/guides/observability/)
- [ ] Set a maximum stale age per use and fail pricing paths closed. [Graceful degradation](/docs/guides/graceful-degradation/)
- [ ] Batch through `/convert` with up to 25 targets, or a paced pool for history. [Bulk and concurrency](/docs/guides/bulk-concurrency/)

## Go-live read

Exercise one success, then force `401`, `403`, `429`, and a simulated `5xx`. Confirm alerts fire, degraded responses are labeled, checkout refuses an expired snapshot, and rollback is config only.

## Related

- [API reference](/docs/api/)
- [Authentication](/docs/authentication/)
- [Errors](/docs/errors/)
- [Rate limits](/docs/rate-limits/)
- [Guides](/docs/guides/)
- [Security](/docs/guides/security/)
- [Caching reference rates](/docs/guides/caching/)
- [Observability](/docs/guides/observability/)