cometchat-angular-v5-production

Ground truth: @cometchat/chat-uikit-angular@5 (5.1.0–5.2.0 verified). The auth-token API is FETCHED from {DOCS_BASE}/ui-kit/angular/methods.md and /integration.md (base + paths in cometchat-angular-v5-core/references/docs-map.md). The Angular UI Kit docs have no dedicated production-hardening page — the checklist below is the pack's own guidance, derived from the credential rules in RULES.md §4 and what the kit ships; it is labelled as such rather than presented as documented. Treat that as a tracked DOCS GAP.

Companion skills (read first)

• cometchat-angular-v5-core — references/setup-credentials.md covers the dev credential flow this replaces.
• cometchat-security — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is not an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.

Use this skill when

Moving off the development setup: going live, a security review, or "is this safe to ship".

The one thing that matters

Never ship the Auth Key in the browser bundle.

The Auth Key can mint a session for any user in your app. Anything in environment.ts is compiled into JavaScript your users download, so an Auth Key there is public. Anyone can read it, log in as any UID, and read every conversation.