Scalekit Production Readiness

Work through each section in order — earlier sections are blockers for later ones. Skip sections that don't apply to this implementation.

Quick checks (run first)

• Production environment URL, client ID, and client secret are set (not dev/staging values)
• HTTPS enforced on all auth endpoints
• CORS restricted to your domains only
• API credentials stored in environment variables — never committed to code
• Only enabled auth methods are active in production

Customization