Going Live
Checklist before your first production deployment.
Before pointing your integration at the production API, go through this checklist.
Pre-Launch Checklist
Execute your BAA — A signed Business Associate Agreement is required before production credentials are issued. Learn more
Rotate your keys — Generate fresh production API keys. Never reuse sandbox keys.
Implement consent token generation — Your server must generate short-lived RS256 JWTs for each user session. See Authentication.
Configure webhook endpoints — Register at least one endpoint to receive async events. See Webhooks.
Set up error handling — Handle 401, 422, 429, and 5xx responses gracefully. See Error Handling.
Review rate limits — Production is capped at 100 requests/minute per partner. See Rate Limits.
Audit your PHI handling — Review your internal data handling for HIPAA compliance. See HIPAA for Integrators.
Questions about the launch process? Email partners@onepath.health — we respond within one business day.