cometchat-react-v7-production

Ground truth: @cometchat/chat-uikit-react@7. The auth-token / login API is FETCHED from the docs via cometchat-react-v7-core/references/docs-map.md (/ui-kit/react/integration-react + the JS SDK auth pages); the REST auth-token endpoint is {DOCS_BASE}/rest-api/auth-tokens. The React UI Kit docs have no single production-hardening page — this checklist is the pack's own guidance from RULES.md §4 (Credentials) + what the kit ships, labelled as such, not presented as documented. Tracked DOCS GAP.

Companion skills (read first)

• cometchat-react-v7-core — references/setup-credentials.md + references/lifecycle.md cover the dev credential flow this replaces and the init→login→render order.
• cometchat-react-v7-patterns — the per-bundler env prefix + build specifics referenced below.
• cometchat-security — the enterprise auth model this client-side hardening plugs into: wiring your IdP / SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is not an IdP), token expiry/refresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.

Use this skill when

Moving off the development setup: going live, a security review, or "is this safe to ship."

The one thing that matters

Never ship the Auth Key in the browser bundle.

The Auth Key can mint a session for any user in your app. Every VITE_/NEXT_PUBLIC_/REACT_APP_/PUBLIC_-prefixed value is compiled into JavaScript your users download — so an Auth Key there is public. Anyone can read it, log in as any UID, and read every conversation.