Launch checklist

​

What changes in production

​

Step 1: Set up your production partner account

1. Sign in to the production Developer Dashboard.
2. In Account → General Settings, copy your production Partner ID. Do not assume it matches your sandbox Partner ID.
3. Fill in your app’s Name, Logo URL, and Website URL. Users see them during login, transactions, issuance, and verification.
4. Register your production JWKS URL. It must be public HTTPS and reachable from AIR servers. See JWKS endpoint setup.
5. Under Account → Domains, add the HTTPS domains that load AIR Kit. You can add up to 3, and wildcards such as *.myapp.example.com are supported. localhost is not available in production.

​

Step 2: Switch the SDK to production

import { AirService, BUILD_ENV } from "@mocanetwork/airkit";

const airService = new AirService({
  partnerId: process.env.NEXT_PUBLIC_PARTNER_ID, // production Partner ID
});

await airService.init({
  buildEnv: BUILD_ENV.PRODUCTION,
  credentialNetwork: "mainnet",
  enableLogging: false,
});

await airService.initialize(
  partnerId: 'YOUR_PRODUCTION_PARTNER_ID',
  navigatorKey: navigatorKey,
  env: Environment.production,
  enableLogging: false,
);

​

Step 3: Point your backend at production

• Sign with the private key whose public key is in your production JWKS, and set the kid to match.
• Keep tokens short-lived and generate them on the server only. See SDK authentication.
• If you call the AIR API directly, for example initialize-user and dstorage/vcs for direct issuance, use the production base URL.

​

Step 4: Set up credentials in production

1. Deploy your issuer service for production on a domain you control, with a durable database and NODE_ENV=production. The reference issuer service uses PostgreSQL. See Issuer backend hosting.
2. Register the issuer in Issuer → Settings on the production Dashboard: the did:web Issuer DID, the issuer API key, the JWKS URL, and the endpoint URLs.
3. Recreate your schemas and issuance programs in the production Dashboard, and update the program IDs in your app.
4. Decide your revocation setup, including whether to enable the token status list, before you issue the first production credential.
5. If you issue Iden3 credentials, contact the AIR team to enable them in production.

1. Recreate your verification programs in the production Dashboard and update the program IDs in your app.
2. Constrain each program to the production Issuer DIDs you trust.
3. Verify every presentation on your backend, with a fresh nonce per verification. See Verify SD-JWT on your backend.

​

Step 5: Set up accounts and gas

• Contact the AIR team to set up gas sponsorship policies and the chains in your partner configuration. See Paymaster.
• If your app or users pay gas on Moca Chain, see How to get $MOCA.
• If you use session keys, scope them to the smallest set of actions and give them short expiry times.

​

Step 6: Test on production before launch

• Log in and log out, including on each mobile platform you ship.
• Issue a credential, verify it, revoke it, and confirm that verification then fails.
• Send a transaction from the smart account, if you use one.
• Check that a request from a domain that is not on your allowed list is refused.

​

Go-live checklist

• Signed in to the production Developer Dashboard, and copied the production Partner ID
• App name, logo URL, and website URL set
• Production JWKS URL is public HTTPS and registered
• Partner JWTs are signed server-side with a key whose kid is in that JWKS, and expire within 5 minutes
• Allowed domains list only your HTTPS production domains
• Private keys and API keys are stored in a secrets manager, not in source control or client code

• Web apps initialize with BUILD_ENV.PRODUCTION and credentialNetwork: "mainnet"
• Flutter apps initialize with Environment.production
• Mobile apps include account.air3.com in their associated domains and asset statements
• No sandbox Partner ID, program ID, or URL remains in the production build
• Logging is off or reduced for production

• Issuer service deployed on a domain you control, with NODE_ENV=production
• The issuer database is durable and its migrations are applied
• did:web Issuer DID, issuer API key, JWKS URL, and endpoint URLs registered in the production Dashboard
• Schemas and issuance programs recreated in production, and their IDs updated in your app
• Revocation tested; token status list partition size final and a publish job scheduled, if you use it
• Iden3 credentials enabled by the AIR team, if you use them

• Verification programs recreated in production, and their IDs updated in your app
• Programs limited to the production Issuer DIDs you trust
• Backend verifies every presentation, including the key-binding JWT, and uses each nonce only once

• Gas sponsorship policies and chains confirmed with the AIR team
• Sponsorship spend is monitored
• Session keys are narrowly scoped with short expiry

• All main flows tested end to end on production
• Alerts set up for failed authentication (spikes in 401 and 403 responses) and unusual issuance volume
• A key rotation plan: add the new key to your JWKS before removing the old one