Going live
The checklist before real users.
Keys
Four kinds, each for one place. Keep each where it belongs.
| Key | Where it goes | What it can do |
|---|---|---|
Public pk_… | Your frontend | Identify the app. Nothing on its own. |
Secret sk_… | Your backend's environment | Sign user tokens, and verify our calls to you. |
Server srv_… | Your backend, if you read usage | Read the usage feed. |
Publish reg_… | Your CI's secrets | Publish the registry. |
To replace a public, server or publish key, create a new one, deploy it, then revoke the old one on the app's page. A revoked key stops at its next request.
The secret key switches the moment you create a new pair. The newest secret is the only one used: from then on, user tokens signed with the old one are refused, and calls to your backend are signed with the new one. So create the pair when you are ready to deploy the new secret straight away, and expect sessions to fail between the two. Then revoke the old pair.
After a leak, create a new pair and revoke the old one straight away. Creating the pair already stops the leaked secret signing anything we accept, and revoking it takes it out of commission for good.
If a key has been pasted somewhere it should not be, treat it as leaked and replace it.
Settings
- Allowed origins. List the origins your app runs on, such as
https://app.example.com. An empty list allows every origin, which is right in development and wrong in production. - Backend endpoints. List only your own backend's origins. Anything else is refused on publish.
- Voice. On only if you mean it. See voice.
Actions
- Review every action's risk tier. Anything that moves money or deletes
data is
high. Anything you would not want run without the user seeing it first asks for confirmation. - Test a high-risk action end to end: ask for it, see the card, tap it, and check your backend received a signed call and the audit log shows who approved it.
- Test a refusal: sign in as a user without the permission, ask for the same thing, and check it is not offered.
- Verify signatures in your backend, against the raw body, and re-check permissions there. See verifying action calls.
Tokens
- Sign them from your session, with the user's real permissions, for 15 minutes or so. Never more than an hour.
- Your token route answers only a signed-in user.
If your app sets a Content-Security-Policy
connect-src wss://runtime.mihe.dev
img-src *.digitaloceanspaces.com (only if you uploaded a launcher icon)Credit
Buy credit, and set a low-balance alert so the first you hear of an empty balance is not from a user.