Scalekit MCP Auth Production Readiness

Work through each section in order — earlier sections are blockers for later ones.

Quick checks (run first)

• Production environment URL, client ID, and client secret are set (not dev/staging values)
• HTTPS enforced on all auth endpoints
• CORS restricted to your domains only
• API credentials stored in environment variables — never committed to code

Core auth flows