intercom-prod-checklist

# Intercom Production Checklist ## Overview Complete checklist for deploying Intercom integrations to production, covering authentication, error handling, rate limits, webhooks, and monitoring. ## Pre-Deployment Checklist ### Authentication and Secrets - [ ] Production access token stored in secret manager (not env files) - [ ] Token has minimal required OAuth scopes - [ ] Token rotation procedure documented and tested - [ ] Separate tokens for dev/staging/production workspaces - [ ] No hardcoded tokens in source code (verified with `grep -r "dG9r" .`) ### API Integration Quality - [ ] All API calls wrapped in error handling (`try/catch` with `IntercomError`) - [ ] 429 rate limit retry with exponential backoff implemented - [ ] 5xx server error retry implemented - [ ] Request timeouts configured (recommended: 30s) - [ ] Pagination handles cursor-based iteration correctly - [ ] Contact search uses compound queries efficiently ### Webhook Endpoints - [ ] Webhook URL uses HTTPS (Intercom requires it) - [ ] `X-Hub-Signature` verification implemented (HMAC-SHA1) - [ ] Webhook handler responds within 5 seconds (Intercom timeout) - [ ] Idempotency: duplicate webhooks handled gracefully - [ ] Failed webhook retry handled (Intercom retries once after 1 min) ### Data Handling - [ ] PII redacted from logs (emails, names, phone numbers) - [ ] Contact data cached with appropriate TTL - [ ] GDPR deletion handler implemented for contact data - [ ] Custom attributes validated befo...