> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Production checklist

> What to verify before taking your Memic integration live.

Before taking a Memic-backed app to production, run through this checklist.
None of it is hard, but missing any one item has bitten customers.

## Environments

* [ ] **Using a `production` environment** — not running prod traffic through
  your `staging` environment
* [ ] **Separate API keys for each environment** — never share keys across
  environments
* [ ] **Keys stored as secrets** — not committed to source control, not in
  client-side code

## Authentication

* [ ] **`X-API-Key` header is set on every request** — otherwise the API
  returns 401
* [ ] **Keys are rotated annually** (or sooner if anyone with access leaves)
* [ ] **API keys are never sent to the browser** — the Memic API should be
  called from your backend, not client-side JavaScript

## Error handling

* [ ] **Retry `5xx` and `429` responses with exponential backoff**
* [ ] **Respect the `Retry-After` header** on 429 responses
* [ ] **Do not retry `4xx` responses** other than 429 — they won't succeed
* [ ] **Log the `request_id`** from error responses so you can correlate
  with Memic support tickets
* [ ] **Surface user-friendly error messages**, not raw JSON

## File ingestion

* [ ] **Poll `/files/{id}/status` until `ready`** before searching — don't
  assume files are immediately searchable
* [ ] **Handle `failed` processing status** — present the reason to the user
  and let them retry
* [ ] **Enforce file size limits in your UI** before uploading to Memic —
  100MB is the Memic limit
* [ ] **Validate file types client-side** too — avoid a round-trip for
  unsupported formats

## Search and chat

* [ ] **Cache identical queries** where appropriate — search and chat are
  rate-limited
* [ ] **Use `top_k` appropriate to your UI** — 5-10 for RAG prompts, 20+ for
  search UIs
* [ ] **Render citations** on chat responses so users can verify answers
* [ ] **Set sensible timeouts** on your HTTP client — 30s for search,
  60s for chat

## Multi-tenancy

* [ ] **One environment per tenant** if you're building multi-tenant
* [ ] **Tenant-to-key mapping is stored server-side** in your database
* [ ] **Your auth layer selects the right key** based on the authenticated
  user's tenant
* [ ] **End-to-end isolation test** — verify that a user in Tenant A cannot
  see results from Tenant B's environment

## Monitoring

* [ ] **Log request latency** from your side of the API call
* [ ] **Alert on error rate spikes** — 429s, 5xxs
* [ ] **Track file processing failures** as a business metric, not just an
  error log

## Going live

* [ ] **Smoke test production end-to-end** — upload a file, wait for ready,
  search, delete
* [ ] **Verify with `GET /me`** that your production code is hitting the
  production environment
* [ ] **Document your rollback procedure** — if a new prompt or code deploy
  causes issues, how do you revert?

## Related

<Card title="Error handling" icon="triangle-exclamation" href="/api-reference/errors" horizontal>
  Full error codes and retry guidance.
</Card>