AgentKit launch checklist

Work through this list in your Production environment before real users connect their accounts. Each item says how to confirm it’s done and links to the steps.

Development and Production share nothing, so most of the work is setting up again in Production what you built in Development.

• Create a Production environment. The environment switcher at the top left lists it. See Create a Production environment.
• Deploy Production credentials. Your production servers use the Production SCALEKIT_ENVIRONMENT_URL, SCALEKIT_CLIENT_ID and SCALEKIT_CLIENT_SECRET, and no Development values remain. The secret’s Last used time updates when your server calls Scalekit. See API credentials.
• Keep the client secret on your server. It isn’t in browser or mobile code, logs or your repository.

• Create every connection your agent uses in Production. Each one appears in AgentKit > Connections in Production. See Set up a connection.
• Match connection names in your code. The connection_name values your code sends match the Production connection names exactly.
• Create your custom connectors and Virtual MCP servers again, if you use them. They belong to one environment, so create them with your Production credentials. See Create a connector and Create a Virtual MCP server.

Skip this section for connections that use Scalekit’s credentials.

A provider creates a new OAuth app in a development or testing mode that only authorizes the account that created it. The connection works while you test with your own account, then fails for your customers. For example, Airtable returns “This OAuth application cannot be used outside of development”.

• Add the Production redirect URI to each app. Copy it from the connection in Production. It differs from Development’s, and it must match exactly. See Use your own OAuth app.
• Publish each app out of development or testing mode, and complete the profile the provider requires first, such as a logo, terms of service and privacy policy.
• Recheck the credentials after publishing. Publishing can change the client ID. The client ID, client secret and scopes in Scalekit match the provider’s.
• Authorize with an account outside your own organization. It connects without an “unverified app” or “needs admin approval” screen. See Troubleshoot connection and OAuth errors.

• Use a stable, internal ID as each user’s identifier. It comes from your authenticated session, never from the request body, and isn’t an email address or shared across users. See Choose an identifier.
• Turn on user verification. In Production, AgentKit > Settings > User Verification is set to Custom user verifier, your authorization links pass user_verify_url, and your verify route confirms the user. See Verify users.
• Send authorization links from your server. A test user can open one, authorize, and reach ACTIVE. See Authorize a user.

• Check status before tool calls, and send a new link when it isn’t ACTIVE. Revoke a test user’s access at the provider, and your app asks them to reconnect. See Manage connected accounts.
• Listen for account events. A webhook endpoint in Production receives connected_account.status_updated, and your handler verifies the signature. See Listen for account events.
• Delete connected accounts when your users delete their accounts. Your account-deletion flow deletes each of the user’s connected accounts, so Scalekit no longer holds their tokens. See Delete a connected account.

• If you use Virtual MCP, mint a session token for each run, on your server. Tokens aren’t stored between runs or sent to a browser. See Mint session tokens.
• Check mcp_server_url before you hand a Virtual MCP server to a client. The value you store for each server isn’t empty. See Check it worked.
• Handle tool call errors and rate limits. Your agent reads the error a failed call returns, and retries with backoff when it gets a 429. See Errors and rate limits.
• Monitor tool calls in AgentKit > Logs. Someone on your team checks AgentKit > Logs for failed calls after launch. See What Scalekit stores.
• Leave Store connector error details off in AgentKit > Logs, unless you’re debugging a connector. With it on, logs keep error responses that can include data from the app. See What Scalekit stores.
• Review what your app is responsible for. See Security and compliance.

• Give each teammate the least access they need. Only people who manage members and billing are Admin. See Team members and roles.
• Choose a plan for Production. Developers > Billing shows its plan and your tool call usage. See Billing.

• Brand the Hosted Connect Widget in Production with your name, logo and colors. See Brand the Hosted Connect Widget.
• Serve Production from your own domain, such as auth.yourapp.com, so users see it on authorization pages. See Set up a custom domain.
• Bring your own encryption key if your security review requires it. See Manage encryption keys.