Skip to content
Konnect ID Docs
Guide · Everyone · 5 min

Go live checklist

What to confirm before you send real customers through.

  1. HTTPS everywhereThe flow domain and any page that links to it must use HTTPS, otherwise the camera is unavailable.
  2. Secrets on the serverAPI key and app secret only in backend environment variables. Rotate anything that was ever exposed.
  3. Webhook endpointPublicly reachable, verifies X-Konnect-Signature on the raw body, rejects old timestamps, deduplicates on delivery id, answers 2xx fast.
  4. ReconciliationFor sessions that stay open, poll /info from your server. Webhook delivery is best effort with four attempts.
  5. Plan and flowsConfirm the monthly quota and allowed flows for the account, so you do not hit 402 or 403 at launch.
  6. Review processNamed reviewers with the right roles, a documented policy for approve versus decline, and a target time for the queue.
  7. CalibrateRun a pilot and review a sample of auto-approved and rejected sessions. Tune FACE_MATCH_THRESHOLD, DOC_BLUR_RETRY, DOC_MIN_SCORE_AUTO.
  8. PrivacyDecide on persistData, a retention period, and what your privacy notice tells applicants.
  9. CapacityThe rate limiter is per process. If you run multiple instances behind a proxy, confirm the client IP is forwarded correctly.
  10. Test end to endOne happy path, one blurry photo, one declined, one webhook failure. Try in English, French and Arabic if you serve them.
Decide your risk model

Automatic checks are heuristics. If your regulator requires certified document authentication or liveness, add a specialist provider; do not rely on auto-approval alone.