adobe-prod-checklist

# Adobe Production Checklist ## Overview Complete checklist for deploying Adobe API integrations to production, covering credential security, health monitoring, graceful degradation, and rollback procedures. ## Prerequisites - Staging environment tested and verified - Production OAuth credentials created in Developer Console - Deployment pipeline with secret injection - Monitoring and alerting infrastructure ready ## Instructions ### Pre-Deployment: Credentials & Configuration - [ ] Production OAuth Server-to-Server credentials created (separate from staging) - [ ] `ADOBE_CLIENT_ID` and `ADOBE_CLIENT_SECRET` stored in secret manager (not env files) - [ ] Scopes are minimal: only APIs actually used in production - [ ] Token caching implemented (avoid re-generating per request) - [ ] I/O Events webhook endpoints use HTTPS with valid TLS cert - [ ] Webhook challenge response handler implemented (for registration) ### Pre-Deployment: Code Quality - [ ] All tests passing (`npm test`) - [ ] No hardcoded credentials (grep for `p8_` prefix patterns) - [ ] Error handling covers: `401`, `403`, `429`, `500`, `503` - [ ] Rate limiting/backoff with `Retry-After` header support - [ ] Webhook signature verification using RSA-SHA256 - [ ] Logging redacts credentials and PII - [ ] API response validation (Zod or equivalent) ### Pre-Deployment: Infrastructure - [ ] Health check endpoint verifies Adobe IMS token generation: ```typescript // api/health.ts export async function adobeH...