webflow-prod-checklist

# Webflow Production Checklist ## Overview Complete pre-deployment checklist for Webflow Data API v2 integrations, covering authentication, error handling, rate limits, monitoring, and rollback. ## Prerequisites - Staging environment tested and verified - Production API token with minimal scopes - Deployment pipeline configured - Monitoring/alerting infrastructure ready ## Instructions ### Pre-Deployment Configuration - [ ] **Production API token** in secure vault (not .env file on server) - [ ] **Minimal scopes** — only scopes the integration actually uses - [ ] **Site token** used where workspace token is not needed - [ ] **Environment variables** set in deployment platform (Vercel/Fly/Cloud Run) - [ ] **Webhook secrets** stored securely, not hardcoded - [ ] **No tokens in client-side code** — all API calls server-side only ### Code Quality Verification - [ ] **All tests passing** — unit tests with mocked SDK, integration tests with test token - [ ] **No hardcoded credentials** — `grep -r "Bearer " src/` returns nothing - [ ] **Error handling** covers 400, 401, 403, 404, 409, 429, 500 - [ ] **Rate limit handling** — SDK `maxRetries` configured, bulk endpoints used - [ ] **Pagination** — all list operations handle `offset`/`limit` correctly - [ ] **Logging** is production-appropriate (no PII, structured JSON) - [ ] **Webhook signatures verified** — `verifyWebhookSignature()` on every webhook ### Rate Limit Readiness - [ ] **Bulk endpoints** used for multi-item ope...