---
title: "Go-live checklist"
description: "A checklist to finish in the sandbox before you ask Flume for live access. It covers credentials, the iframe, errors, limits and what to send Flume."
url: https://docs.tryflume.ai/go-live
updated: 2026-11-11
---

# Go-live checklist

> A checklist to finish in the sandbox before you ask Flume for live access. It covers credentials, the iframe, errors, limits and what to send Flume.

Finish this checklist in the sandbox, then ask Flume for live access. Live is in early access: Flume is not yet opening it to new partners, and enables it by request, one partner at a time. Do not plan a launch on live until Flume confirms your platform is enabled. Copy the list into your own tracker.

## Credentials

- [ ] The partner key is in a secret manager. It is not in source control or a client bundle.
- [ ] Each user access token is stored encrypted, on your server, against one user.
- [ ] No key or token is ever sent to a browser or written to a log.
- [ ] You log the key prefix and `X-Request-Id` for failed calls.
- [ ] You have [rotated a key](https://docs.tryflume.ai/guides/rotate-keys.md) once in the sandbox.

## Users

- [ ] `external_ref` is a permanent id that you never reuse.
- [ ] You handle a wrong code, an expired code and a resend.
- [ ] On `401` `USER_TOKEN_INVALID`, you delete the token and verify the user again.
- [ ] You overwrite the stored token every time a user verifies.

## Iframe

Skip this section if you use the API only.

- [ ] The iframe tag has exactly the [five sandbox tokens](https://docs.tryflume.ai/embed/host-page.md#the-iframe-tag).
- [ ] You read the iframe origin from `iframe_url`. It is not hardcoded.
- [ ] Your listener makes the [four checks](https://docs.tryflume.ai/embed/messages.md#checks-your-page-must-make).
- [ ] You reply to the iframe with its origin as the target, never `"*"`.
- [ ] The ready timer removes the iframe and shows an error with a retry.
- [ ] You call `stop()` when your page removes the iframe itself.
- [ ] You always send the stored token on `POST /start-iframe-session`.
- [ ] You exchange the connect code at once, check `external_ref`, and store the token.
- [ ] A repeated `save_uuid` writes nothing twice.
- [ ] A failed write replies `flume:item_save_failed` with the `save_uuid`.
- [ ] You reply to `flume:save_item` within 60 seconds.
- [ ] You copy image bytes on save, and store `product_url`.
- [ ] You do not store a price that came through the browser without [checking it](https://docs.tryflume.ai/embed/security.md#can-you-trust-the-save-payload).
- [ ] On `flume:close_iframe` with `expired`, you start a new session.
- [ ] Your CSP allows the iframe origin in `frame-src`.
- [ ] You log `session_uuid` with your item id and user id.

## API

Skip this section if you use the iframe only.

- [ ] You send a new `Idempotency-Key` per user action, and reuse it only to retry.
- [ ] Your HTTP read timeout on `POST /request-instant-quote` is 75 seconds.
- [ ] You poll `GET /quotes/{quote_uuid}` on `TEMPORARILY_UNAVAILABLE`, and stop after 5 minutes.
- [ ] You pass the `search_session_uuid` of the page that returned the product.
- [ ] You treat money as a decimal string.
- [ ] You build filter menus from `GET /filters`.
- [ ] You do not store image links or deep link URLs.

## Errors and limits

- [ ] You branch on `error.code`, never on `error.message`.
- [ ] You retry only `429`, `500`, `502`, `503` and `IDEMPOTENCY_IN_PROGRESS`.
- [ ] You honor `Retry-After`.
- [ ] You handle a response that is not JSON.
- [ ] You know your expected daily volume against the [limits](https://docs.tryflume.ai/concepts/limits.md).

## Send this to Flume

When the list is done, [ask Flume](https://docs.tryflume.ai/support.md#ask-for-live-access) for live access. Include:

| Item | Example |
|---|---|
| Your page origins for live | `https://app.acme.example` |
| Image hosts for `item.image_urls` | `cdn.acme.example` |
| Redirect hosts for deep links | `app.acme.example` |
| Countries your servers and users are in | United States |
| Expected searches and quotes per day | 300 searches, 60 quotes |
| A contact for incidents | An email address |

## After Flume enables live

1. Store the live key. It starts with `sk_prod_`.
2. Switch the base URL to `https://ssapi.tryflume.ai/partner/v1`.
3. Verify each user again. Sandbox tokens do not work on live.
4. Read the iframe origin from a live `iframe_url`, and add it to your CSP.
5. Run one full flow with a real user before you announce it.