Scalekit Agent Auth Production Readiness

Work through each section in order — earlier sections are blockers for later ones.

Quick checks (run first)

• Production environment URL, client ID, and client secret are set (not dev/staging values)
• HTTPS enforced on all auth endpoints
• API credentials stored in environment variables — never committed to code
• Redirect URIs registered in dashboard match exactly what the app sends

OAuth token flows