clade-prod-checklist

# Anthropic Production Checklist ## Overview Before going live with a Claude-powered app, verify every item below. ## Authentication & Security - [ ] API key stored in secrets manager (not in code or env file on disk) - [ ] Key rotated — not the same one used during development - [ ] Server-side only — no key exposed to client/browser - [ ] Per-user rate limiting in place - [ ] Input validation: max length, content filtering - [ ] System prompt includes injection guardrails ## Output - All checklist items verified (authentication, error handling, streaming, cost, monitoring, reliability, content, performance) - Production API key configured with appropriate spending limits - Monitoring and alerting in place - Fallback behavior tested for API outages ## Error Handling - [ ] All Anthropic API calls wrapped in try/catch - [ ] `RateLimitError` (429) → backoff and retry - [ ] `OverloadedError` (529) → fallback model or queue - [ ] `AuthenticationError` (401) → alert team, don't retry - [ ] `InvalidRequestError` (400) → log and fix, don't retry - [ ] Network errors → retry with backoff - [ ] Request IDs logged for every error (for support tickets) ## Streaming - [ ] Using `client.messages.stream()` for user-facing responses - [ ] Stream errors handled (connection drops, incomplete responses) - [ ] `stop_reason` checked: `end_turn` vs `max_tokens` (incomplete) ## Cost Controls - [ ] `max_tokens` set to realistic values (not 4096 for short answers) - [ ] Correct model for each ...