linktree-prod-checklist

# Linktree Production Checklist ## Overview Linktree profiles serve as the single gateway between a creator's social audience and their monetized destinations. A misconfigured integration can silently drop link-click analytics, leak API keys through client-side calls, or trip the 100 req/min rate limit during viral traffic spikes. This checklist hardens your Linktree API integration for production-grade reliability, ensuring click tracking stays accurate, webhook delivery remains verified, and your link-in-bio pages load under high concurrency. ## Prerequisites - Production Linktree API key (not sandbox/dev key) - Secrets manager configured (Vault, AWS Secrets Manager, or GCP Secret Manager) - Monitoring stack operational (Datadog, Grafana, or CloudWatch) - Staging environment validated with synthetic traffic test ## Authentication & Secrets - [ ] API keys stored in vault/secrets manager (never in code or environment files) - [ ] Key rotation schedule configured (every 90 days) - [ ] Separate keys for staging vs production environments - [ ] Bearer token included in Authorization header, not query params - [ ] API key scopes restricted to minimum required permissions (read-only where possible) ## API Integration - [ ] Base URL points to `https://api.linktr.ee/v1` (production, not sandbox) - [ ] Rate limiting enforced client-side at 90 req/min (buffer below 100 req/min hard limit) - [ ] Pagination implemented for profile link listing (cursor-based, not offset) - [ ] Reques...