Production Checklist

Work through this list before real customers connect accounts.

Workspace and credentials

A separate production workspace, apart from development and staging. See Workspaces.
Production OAuth apps at each provider, separate from development ones, with https://auth.bundleup.io/callback as the callback URL.
Any provider app review completed for the scopes you request. Some providers limit unreviewed apps to a few users or show a warning screen.
API keys stored in a secrets manager or environment variables, never in source control or client code. One key per service, named so logs show which one made each call.
Only the people who need it have the admin or owner role. See Team & members.

Production redirect URIs registered under Auth, exactly matching what your app sends.
A random state generated per flow and checked in your callback. See Protect the flow with state.
external_id set to your user or account ID, so you can find connections later.
The callback handles error redirects (especially access_denied) with a friendly message and a retry button.
The code exchange happens server-side, within 5 minutes of the redirect.
Connection IDs are stored against the right user. Old connections are deleted when a user reconnects.

Your code picks the connection ID for the signed-in user on the server, and never accepts one from the client.
Errors are split into BundleUp errors and provider errors, and handled as described in Handling errors.
A “needs reconnect” state and a Reconnect button for connections that lose access.
Bulk jobs stay under 100 requests per minute per connection, with backoff on 429. See Rate limits.
Writes that might be retried use the provider’s idempotency keys where available.
Integration scopes are the minimum you need. See Choosing scopes.

A webhook for at least connection.created and connection.deleted, if you rely on connections being in your database.
Signatures verified with the raw body, and timestamps checked. See Verifying signatures.
The endpoint responds within 3 seconds and processes events asynchronously.
A periodic reconciliation job, since failed deliveries aren’t resent.

You’ve decided between model-hosted MCP (API key sent to the model provider) and an MCP client in your backend. See Using MCP clients.
Each agent run only gets the signed-in user’s connections.
Tool lists are filtered to what the agent needs.

Your plan covers expected monthly requests, including retries. See Pricing.
Someone knows where to look: the dashboard’s Logs page and your own application logs, linked by connection ID.