miro-prod-checklist

# Miro Production Checklist ## Overview Complete checklist for deploying Miro REST API v2 integrations to production, covering OAuth configuration, rate limit readiness, monitoring, and rollback. ## Pre-Deployment: OAuth & Scopes - [ ] **Production Miro app created** at https://developers.miro.com (separate from dev app) - [ ] **OAuth scopes minimized** — only scopes actively used (see `miro-security-basics`) - [ ] **Redirect URI** points to production HTTPS endpoint - [ ] **Client secret** stored in secret manager (not env vars on disk) - [ ] **Token refresh** logic tested — handles expired tokens gracefully - [ ] **Token storage** uses encrypted database or vault (not filesystem) ## Pre-Deployment: Code Quality - [ ] **No hardcoded tokens** — scan with `grep -r "eyJ\|Bearer " src/` - [ ] **Error handling** covers all Miro HTTP status codes (400, 401, 403, 404, 429, 5xx) - [ ] **Rate limiting** — backoff with `Retry-After` header support (see `miro-rate-limits`) - [ ] **Webhook signatures** validated with timing-safe comparison - [ ] **Pagination** handled for all list endpoints (`cursor` parameter) - [ ] **Content-Type** header set to `application/json` on all POST/PATCH requests - [ ] **All tests passing** including integration tests against test board ## Pre-Deployment: Infrastructure - [ ] **Health check** endpoint verifies Miro API connectivity ```typescript // GET /health async function healthCheck() { const start = Date.now(); try { const response = a...