Anthropic Production Checklist

Overview

Before going live with a Claude-powered app, verify every item below.

Authentication & Security

• API key stored in secrets manager (not in code or env file on disk)
• Key rotated — not the same one used during development
• Server-side only — no key exposed to client/browser
• Per-user rate limiting in place
• Input validation: max length, content filtering
• System prompt includes injection guardrails

Output