Go-live checklist

Finish this checklist in the sandbox, then ask Flume for live access. Live is in early access: Flume is not yet opening it to new partners, and enables it by request, one partner at a time. Do not plan a launch on live until Flume confirms your platform is enabled. Copy the list into your own tracker.

Credentials

☐ The partner key is in a secret manager. It is not in source control or a client bundle.
☐ Each user access token is stored encrypted, on your server, against one user.
☐ No key or token is ever sent to a browser or written to a log.
☐ You log the key prefix and X-Request-Id for failed calls.
☐ You have rotated a key once in the sandbox.

Users

☐ external_ref is a permanent id that you never reuse.
☐ You handle a wrong code, an expired code and a resend.
☐ On 401 USER_TOKEN_INVALID, you delete the token and verify the user again.
☐ You overwrite the stored token every time a user verifies.

Iframe

Skip this section if you use the API only.

☐ The iframe tag has exactly the five sandbox tokens.
☐ You read the iframe origin from iframe_url. It is not hardcoded.
☐ Your listener makes the four checks.
☐ You reply to the iframe with its origin as the target, never "*".
☐ The ready timer removes the iframe and shows an error with a retry.
☐ You call stop() when your page removes the iframe itself.
☐ You always send the stored token on POST /start-iframe-session.
☐ You exchange the connect code at once, check external_ref, and store the token.
☐ A repeated save_uuid writes nothing twice.
☐ A failed write replies flume:item_save_failed with the save_uuid.
☐ You reply to flume:save_item within 60 seconds.
☐ You copy image bytes on save, and store product_url.
☐ You do not store a price that came through the browser without checking it.
☐ On flume:close_iframe with expired, you start a new session.
☐ Your CSP allows the iframe origin in frame-src.
☐ You log session_uuid with your item id and user id.

API

Skip this section if you use the iframe only.

☐ You send a new Idempotency-Key per user action, and reuse it only to retry.
☐ Your HTTP read timeout on POST /request-instant-quote is 75 seconds.
☐ You poll GET /quotes/{quote_uuid} on TEMPORARILY_UNAVAILABLE, and stop after 5 minutes.
☐ You pass the search_session_uuid of the page that returned the product.
☐ You treat money as a decimal string.
☐ You build filter menus from GET /filters.
☐ You do not store image links or deep link URLs.

Errors and limits

☐ You branch on error.code, never on error.message.
☐ You retry only 429, 500, 502, 503 and IDEMPOTENCY_IN_PROGRESS.
☐ You honor Retry-After.
☐ You handle a response that is not JSON.
☐ You know your expected daily volume against the limits.

Send this to Flume

When the list is done, ask Flume for live access. Include:

Item	Example
Your page origins for live	`https://app.acme.example`
Image hosts for `item.image_urls`	`cdn.acme.example`
Redirect hosts for deep links	`app.acme.example`
Countries your servers and users are in	United States
Expected searches and quotes per day	300 searches, 60 quotes
A contact for incidents	An email address

After Flume enables live

Store the live key. It starts with sk_prod_.
Switch the base URL to https://ssapi.tryflume.ai/partner/v1.
Verify each user again. Sandbox tokens do not work on live.
Read the iframe origin from a live iframe_url, and add it to your CSP.
Run one full flow with a real user before you announce it.