Skip to main content

Go-Live Checklist

Run through this before flipping your bridge to production.

Correctness​

  • Production API key issued, key_type=live, stored in a secrets manager (not in source control).

  • Connection approved for every meeting space you will mirror.

  • webhook_url verified reachable and returns 2xx.

  • metadata.external_event_id set on every create.

  • (external_event_id → zenspace_booking_id) persistence is durable (survives bridge restart).

  • Timezone conversions verified — create a booking for 2pm local time and confirm start_time in the response is the correct UTC value.

Resilience​

  • Retry policy implemented on 5xx (exponential backoff, cap).

  • Dead-letter queue or alert for repeated failures.

  • Webhook handler is idempotent and responds under 2s.

  • Webhook URL uses a hard-to-guess path and is HTTPS only.

  • Google events.watch channel renewal scheduled (channels expire ~7 days).

Security​

  • API key is not logged.

  • API key is rotatable (you can roll it without downtime).

  • IP allowlist on the API key if your bridge has a stable egress IP.

  • TLS verified on all outbound calls to ZenSpace.

Operational​

  • Logs include booking_id, external_event_id, and connection_id for every request.

  • Metrics: create/update/cancel rates, error rates, webhook ingestion rate.

  • Runbook for the top 3 error messages (connection not approved, time overlap, invalid API key).