WitnessOps · production SaaS gate

Production readiness

Fail-closed checklist for enabling the SaaS app, API, provider integrations, billing, database, and deployment surfaces.

production blockedexplicit enable missing0 required missing7 placeholder0 invalid shape
Required missing0must be zero before production enable
Enable flagoffWITNESSOPS_PRODUCTION_ENABLE
Required placeholder7must be zero before production enable
Invalid shape0live-shaped values only
APIJSON/api/production/readiness

Provider cutover plan

5 actions

Clerk production app

blocked

Install Clerk live secret, live publishable key, and production webhook secret in the provider source.

  • CLERK_SECRET_KEYplaceholder_or_test
  • NEXT_PUBLIC_CLERK_PUBLISHABLE_KEYplaceholder_or_test
  • CLERK_WEBHOOK_SECRETplaceholder_or_test
npm run production:provider-source:upsertnpm run production:runtime-env:materializenpm run production:blockers

Stripe live billing

blocked

Install Stripe live secret and live webhook secret after live products, prices, and webhook endpoint are configured.

  • STRIPE_SECRET_KEYplaceholder_or_test
  • STRIPE_WEBHOOK_SECRETplaceholder_or_test
npm run production:provider-source:upsertnpm run production:runtime-env:materializenpm run production:blockers

Resend sender

blocked

Install a Resend API token and verified production sender address.

  • RESEND_TOKENplaceholder_or_test
npm run production:provider-source:upsertnpm run production:runtime-env:materializenpm run production:blockers

Arcjet protection

blocked

Install the Arcjet production key.

  • ARCJET_KEYplaceholder_or_test
npm run production:provider-source:upsertnpm run production:runtime-env:materializenpm run production:blockers

Final production enable flag

pending

Keep production disabled until provider live checks, migrations, images, deploy status, ingress, public probes, and webhook smoke checks pass.

  • WITNESSOPS_PRODUCTION_ENABLEmust_remain_false_until_cutover
WITNESSOPS_RUNTIME_ENV_REQUIRE_ENABLE=true npm run production:runtime-env:verifynpm run production:cutover:verify

Core URLs

5/5 ready
  • present
    Public marketing URLNEXT_PUBLIC_WEB_URL
  • present
    Authenticated app URLNEXT_PUBLIC_APP_URL
  • present
    API URLNEXT_PUBLIC_API_URL
  • present
    Operator shell URLWITNESSOPS_OPERATOR_URL
  • present
    Production host URLVERCEL_PROJECT_PRODUCTION_URL

Authentication

4/7 ready
  • placeholder
    Clerk server keyCLERK_SECRET_KEY
  • placeholder
    Clerk webhook secretCLERK_WEBHOOK_SECRET
  • placeholder
    Clerk publishable keyNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
  • present
    Clerk sign-in URLNEXT_PUBLIC_CLERK_SIGN_IN_URL
  • present
    Clerk sign-up URLNEXT_PUBLIC_CLERK_SIGN_UP_URL
  • present
    Clerk post sign-in URLNEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL
  • present
    Clerk post sign-up URLNEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL

Database

1/1 ready
  • present
    Neon/Postgres database URLDATABASE_URL

Billing

0/2 ready
  • placeholder
    Stripe secret keySTRIPE_SECRET_KEY
  • placeholder
    Stripe webhook secretSTRIPE_WEBHOOK_SECRET

Email

1/2 ready
  • placeholder
    Resend API tokenRESEND_TOKEN
  • present
    Transactional senderRESEND_FROM

Security

2/3 ready
  • placeholder
    Arcjet keyARCJET_KEY
  • present
    Feature flag secretFLAGS_SECRET
  • present
    Entitlement enforcement flagENTITLEMENTS_ENFORCED

Observability

0/5 ready
  • optional
    BetterStack API keyBETTERSTACK_API_KEY
  • optional
    BetterStack ingest URLBETTERSTACK_URL
  • optional
    Google Analytics measurement IDNEXT_PUBLIC_GA_MEASUREMENT_ID
  • optional
    PostHog keyNEXT_PUBLIC_POSTHOG_KEY
  • optional
    PostHog hostNEXT_PUBLIC_POSTHOG_HOST

Content and collaboration

0/5 ready
  • optional
    BaseHub tokenBASEHUB_TOKEN
  • optional
    Liveblocks secretLIVEBLOCKS_SECRET
  • optional
    Svix tokenSVIX_TOKEN
  • optional
    Knock API keyKNOCK_API_KEY
  • optional
    Knock feed channelKNOCK_FEED_CHANNEL_ID

Gate notes

fail closed
  • No secret values are returned by this readiness check.
  • WITNESSOPS_PRODUCTION_ENABLE must equal true, every required item must be present, and required values must not match known placeholders or invalid production shapes before production is enabled.
  • This gate rejects obvious template values, local URLs, known test-key prefixes, and weak production-shaped values, but it does not prove third-party account validity.