Going live

Money#

• Stripe is out of test mode and the live keys are in production
• The webhook endpoint points at the real domain, with its own signing secret, not the test one
• checkout.session.completed and charge.refunded are both enabled
• A real card has bought a real plan and the order landed in the database
• That payment has been refunded, and the refund unwound what the sale created
• Stripe Tax has a registration for your own country

Access#

• SUPABASE_SECRET_KEY appears in no NEXT_PUBLIC_ variable and no client component
• Reading each table with the publishable key alone returns nothing
• Signed-in pages carry robots: { index: false }
• ADMIN_EMAILS contains only people who should see everyone's data
• Any key that was ever pasted into a chat has been rotated

Email#

• The domain is verified in Resend and mail reaches an address you do not own
• Supabase SMTP points at Resend, port sent as a string
• All three auth templates use ?token_hash=, not the default {{ .ConfirmationURL }}
• A magic link opened on a phone signs you in on that phone

The app#

• Every page renders at 360px with no horizontal scroll
• Both themes render every page, including the code blocks
• Every link in the nav and the footer goes somewhere that exists
• Sign out, then open a bookmarked signed-in URL: it redirects, not 500s
• Nothing in the copy describes a feature you have not built

Content#

• Terms, privacy and refund policy exist and are linked from checkout
• The refund promise in your copy matches what your webhook does
• No invented testimonials, no invented customer counts
• NEXT_PUBLIC_SITE_URL is the canonical domain, and the sitemap agrees

After#

Watch the Stripe event log for the first day, not your own logs. It tells you whether your webhook returned 200, and Stripe retries a failure for three days, which is usually long enough to fix it before anyone notices.