Release checklist

Release checklist

Use this before you ship to production. Overseas docs do not publish domestic-style billing tables or invoice workflows.

Goal

Confirm API limits, client privacy obligations, token storage, and log capture before you release.

Prerequisites

Complete at least one end-to-end path, for example First API call, SDK first preview, or Console first live view.

API limits

Each OpenAPI method has a daily call limit. The catalog is in Interface call limits.
Hitting a per-method daily cap returns OP1014. See Return codes · OP.
Unpublished apps or app-level quotas may return OP1011 on the same page.
Design retries and batch jobs so you do not depend on unlimited calls to accessToken, bindDevice, or live creation APIs.

Privacy

Server-only integration: read API Privacy Policy and disclose API use in your product policy.
Client OpenSDK integration: also ship OpenSDK privacy policy to end users in a visible place, as required there.
Package names and update dates for SDKs you ship are listed on Downloads.

Tokens and secrets

AppSecret, administrator accessToken, sub-account tokens, and kitToken stay on your server. See Tokens.
Sign requests with Signature. Never embed secrets in mobile, desktop, or browser packages.
End-user OAuth flows use project keys and Ot_ tokens as in OAuth 2.0 authorization, not the administrator token in the client.

Logging

When preview or API calls fail after you verified parameters, enable SDK logs and attach a redacted trace to support mail. Steps: Collect SDK logs.

Verify

Production builds do not contain AppSecret or live play URLs in source control.
You can explain where tokens are minted and how they expire.
You know which limit row applies to your hottest APIs.