Go-live checklist

Configuration

• Production uses the production client ID and client secret.
• Every production callback URL is registered exactly.
• No development or staging secret is deployed to production.
• Client secrets and refresh tokens are stored in a managed server-side secret store.

Security

• All login and callback routes use HTTPS.
• state, nonce, and PKCE S256 are generated for every authorization request.
• The callback validates state before exchanging a code.
• Tokens never appear in application logs, analytics events, URLs, or frontend storage.
• Cookies are Secure, HttpOnly, and use an appropriate SameSite policy.
• Logout invalidates the local session.

Experience

• Protected content returns the user to the intended page after login.
• Public content remains accessible without authentication.
• Consent cancellation and other OAuth errors lead to a clear recovery path.
• Ineligible or incomplete profiles receive an appropriate explanation.
• Mobile, tablet, and desktop journeys have been tested.

Operations

• The support team knows how to reproduce login problems.
• Monitoring distinguishes application errors from OAuth errors.
• A credential-rotation owner and process are documented.
• Analytics and campaign behavior, if licensed, has been accepted by the business owner.