Go-live checklist

​

The application

• The application is approved. Codes need an approved application: until then a live key answers 403 account_not_active on Verify. Application settings → Details shows where the review stands. WhatsApp messages already send while it is in review.
• Its names and website are final. Changing a name or the website sends an active application back to review, and codes stop until it is approved again. See How Tawked works.

​

The live key

• One live key per system, named after it, created under Application settings → API keys with Create a key.
• The least access it needs. A server that only checks codes gets Verify, check only. A server that only sends WhatsApp gets Notifications, send. See Key access.
• An IP allowlist with your servers’ addresses, and an expiry if the key is for a fixed project. See Authentication.
• The key lives in your secret manager and reaches only your servers. Never a browser, a mobile app or a repository.
• A rotation you have tried: create the new key, deploy it, then revoke the old one.

​

Tawked Verify

• client_ip on every start made for a user’s request. It is the only way the per-IP cap can tell one abuser from many users. See Reliability and limits.
• An Idempotency-Key per attempt, and a 502 or a network error retried with the same key, so a retry never sends or charges twice.
• reference set to your own order or session id, so you can find a verification in Verify → Verifications.
• A daily spend cap under Verify → Settings if a runaway loop would hurt. It is off by default.
• Your sign-in screen handles each outcome of check, the resend limit and an expired code. See Build a sign-in flow.

​

Tawked Notifications

• The number is connected under Notifications → Overview, and its health is good there.
• Every template you send is approved by Meta under Notifications → Templates. A send of any other answers 422 template_not_approved or 422 unknown_template.
• Marketing templates handle 422 consent_opted_out: the customer asked to stop your offers. Do not retry it. See Sending messages.
• Someone answers replies in Tawked Chat. See Tawked Chat.

​

Webhooks

• An https:// URL on a public host that answers itself: a redirect counts as a failed attempt.
• The signature is verified on the raw body, and old timestamps are refused. See Webhooks.
• Your endpoint answers 2xx within 5 seconds and does its work afterwards. A slower or failed answer is retried.
• Your handler is idempotent on data.id and the event name: the same event can arrive twice.
• You sent a test event with Send a test event on the Webhooks page, and your handler skipped it because it carries "test": true.

​

The balance

• Enough balance for your first days, topped up under Wallet. There is no billing API.
• A low-balance alert under Wallet → Balance, set high enough to top up before sends stop.
• 402 insufficient_credits handled: tell your user to try again later, alert your team, and do not retry until you top up.

​

Errors and support

• You match on the error string, not on the HTTP status. Two different 429s mean different things. See Errors.
• A 429 backs off. The per-key limit is a fixed 60-second window and sends no Retry-After header, so wait and retry within the minute.
• You log X-Request-Id from every response. Quote it when you write to support@tawked.com.
• You follow the changelog or its RSS feed, where breaking changes are announced.