navan-prod-checklist

# Navan Production Checklist ## Overview Gated production readiness verification for Navan REST API integrations. Navan has no SDK and no sandbox — production is the only environment, making this checklist critical. ## Prerequisites - Navan admin access (Admin > Travel admin > Settings) - OAuth credentials stored in a secret manager (credentials are viewable only once) - SSO identity provider configured (Okta, Azure AD, or Google Workspace) - `curl` and `jq` for verification commands ## Instructions ### Domain 1 — Credential Security - [ ] **Secret storage**: OAuth `client_id` and `client_secret` stored in a secret manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault) — never in environment variables, config files, or source control - [ ] **Rotation plan documented**: Schedule for rotating credentials (recommend 90-day cycle) - [ ] **Zero-downtime rotation tested**: Dual-credential swap procedure validated ```bash # Verify current credentials work curl -s -X POST "https://api.navan.com/ta-auth/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET" \ | jq '{authenticated: (.access_token != null), error: .error}' ``` **Rotation procedure:** 1. Generate new credentials in Admin > Integrations (old ones remain valid) 2. Deploy new credentials to secret manager 3. Update application configuration to reference new secret version 4. Verify new c...