> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tawked.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Go-live checklist

> What to check before your first real customer: the application, the live key, retries and limits, webhooks, the balance, and what to log.

Your test key proved the integration. Go through this list once before you switch to the live key. Each item links to the page that explains it.

## The application

* [ ] **The application is approved.** Codes need an approved application: until then a live key answers `403 account_not_active` on Verify. **Application settings → Details** shows where the review stands. WhatsApp messages already send while it is in review.
* [ ] **Its names and website are final.** Changing a name or the website sends an active application back to review, and codes stop until it is approved again. See [How Tawked works](/concepts#review).

## The live key

* [ ] **One live key per system**, named after it, created under **Application settings → API keys** with **Create a key**.
* [ ] **The least access it needs.** A server that only checks codes gets Verify, check only. A server that only sends WhatsApp gets Notifications, send. See [Key access](/authentication#key-access).
* [ ] **An IP allowlist** with your servers' addresses, and an **expiry** if the key is for a fixed project. See [Authentication](/authentication).
* [ ] **The key lives in your secret manager** and reaches only your servers. Never a browser, a mobile app or a repository.
* [ ] **A rotation you have tried**: create the new key, deploy it, then revoke the old one.

## Tawked Verify

* [ ] **`client_ip` on every `start`** made for a user's request. It is the only way the per-IP cap can tell one abuser from many users. See [Reliability and limits](/reliability).
* [ ] **An `Idempotency-Key` per attempt**, and a `502` or a network error retried with the same key, so a retry never sends or charges twice.
* [ ] **`reference`** set to your own order or session id, so you can find a verification in **Verify → Verifications**.
* [ ] **A daily spend cap** under **Verify → Settings** if a runaway loop would hurt. It is off by default.
* [ ] **Your sign-in screen** handles each outcome of `check`, the resend limit and an expired code. See [Build a sign-in flow](/verify/sign-in-flow).

## Tawked Notifications

* [ ] **The number is connected** under **Notifications → Overview**, and its health is good there.
* [ ] **Every template you send is approved** by Meta under **Notifications → Templates**. A send of any other answers `422 template_not_approved` or `422 unknown_template`.
* [ ] **Marketing templates** handle `422 consent_opted_out`: the customer asked to stop your offers. Do not retry it. See [Sending messages](/whatsapp/messages).
* [ ] **Someone answers replies** in Tawked Chat. See [Tawked Chat](/chat).

## Webhooks

* [ ] **An `https://` URL on a public host** that answers itself: a redirect counts as a failed attempt.
* [ ] **The signature is verified** on the raw body, and old timestamps are refused. See [Webhooks](/webhooks).
* [ ] **Your endpoint answers `2xx` within 5 seconds** and does its work afterwards. A slower or failed answer is retried.
* [ ] **Your handler is idempotent** on `data.id` and the event name: the same event can arrive twice.
* [ ] **You sent a test event** with **Send a test event** on the Webhooks page, and your handler skipped it because it carries `"test": true`.

## The balance

* [ ] **Enough balance** for your first days, topped up under **Wallet**. There is no billing API.
* [ ] **A low-balance alert** under **Wallet → Balance**, set high enough to top up before sends stop.
* [ ] **`402 insufficient_credits` handled**: tell your user to try again later, alert your team, and do not retry until you top up.

## Errors and support

* [ ] **You match on the `error` string**, not on the HTTP status. Two different `429`s mean different things. See [Errors](/errors).
* [ ] **A `429` backs off.** The per-key limit is a fixed 60-second window and sends no `Retry-After` header, so wait and retry within the minute.
* [ ] **You log `X-Request-Id`** from every response. Quote it when you write to [support@tawked.com](mailto:support@tawked.com).
* [ ] **You follow the [changelog](/changelog)** or its RSS feed, where breaking changes are announced.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.