Production readiness checklist
Verify API keys, sender status, message status, webhooks, quotas, and operator recovery before launch.
Required checks
Complete every item before enabling production traffic. If one item fails, fix it before increasing volume.
- API key stored server-side: key is in backend env/secret manager, not browser JavaScript.
- Sender mode verified: managed routing omits `sender_id`; connected mode uses only an assigned `connected` sender.
- Paid sender assignment verified: `GET /api/senders` with the production key returns the configured sender.
- Test message queues: cURL or SDK returns HTTP 201 with `status: queued`.
- Message status changes: polling shows `sent` or `failed` with useful timestamps/error message.
- Webhook signed event received: receiver verifies `x-wa-signature` using raw body and stores `x-wa-delivery-id`.
- Quota/rate errors are useful: application shows operator guidance for 429, quota, and sender limit errors.
Launch safeguards
Production integrations should be observable and reversible. Keep message volume low until sender health, webhook delivery, and support workflows are proven.
- Use separate API keys for OTP, transactional sends, and support tools.
- Use idempotency keys for every business event that can be retried.
- Alert on failed webhook deliveries, sender disconnects, daily limit usage, and monthly quota usage.
- Rotate keys after incidents and revoke unused clients.
- Document the operator path: reconnect sender, upgrade plan, unblock recipient, retry webhook, or retry message.
Need help?
Use Book Integration Help if you want setup help for OTP or automated customer messaging.
Continue building
Next steps
Start here
A plain-language map of Free Sandbox, paid sender modes, credentials, and the first successful request.
Free Sandbox quickstart
The shortest beginner path from a verified account to a queued Free Sandbox OTP.
Glossary
Understand workspaces, keys, senders, receivers, queue states, webhooks, and idempotency.
Authentication and access
HookMessage separates customer API keys, dashboard sessions, and internal platform access.