Skip to main content

Launch Checklist

Before deploying your Turnkey integration in production, take a look at our recommendations below. This checklist will guide you through a few important steps and considerations to help ensure your setup is secure, efficient and ready for prime time.

Production Setup​

  • Many of our customers prefer to maintain separate Development and Production organizations. If you choose to do so, ensure your production environment is referencing the correct organization ID.
  • Ensure you have an active subscription via the Account Settings page in the Turnkey dashboard.
  • If you are on an Enterprise plan, confirm your production organization ID with your account rep.
  • Double check our resource limits and rate limits to ensure your implementation will not trigger these limits at production scale.

Security​

  • Lock down your root quorum. We recommend a quorum of at least 3 with a threshold of at least 2.
  • Ensure any team members with critical permissions, especially root quorum members, have set up at least two authenticators for their account (e.g., touchID plus a hardware authenticator like a Yubikey).
  • Avoid using root user permissions for routine operations and instead use standard users with permissions explicitly granted via policies to limit the surface area of a compromised user.
  • Confirm that all API keys are stored securely and not embedded in exposed or vulnerable parts of the codebase. API keys should be stored in a secure, encrypted environment and should never be hard-coded in publicly accessible repositories or client-side code.

Logging​

  • Key identifiers in our service include sub-organization IDs, wallet IDs and addresses. Ensure these identifiers are securely stored, associated with your users as necessary.
  • Set up logging for activities and include relevant identifiers needed for audit, compliance, or troubleshooting purposes. We recommend logging activity IDs, status, creation date, as well as credential IDs and public keys of the approvers. You should also log other resource IDs if relevant for your data model (policies, tags, wallets, accounts, etc)

Errors and Retries​

  • Activity submission is optimistically synchronous. In most cases activities will be completed and returned right away (synchronously), but if there is a lot of activity in a single organization, activities will be processed asynchronously. Make sure you handle PENDING activities by polling a few times until their completion. You can use createActivityPoller to do this if you're using our Typescript SDK.
  • Implement retry strategies for API calls, adjusting for various error types and avoiding over-retrying on critical failures. Incorporate rate limiting and exponential backoff in retry mechanisms.
  • Set up monitoring to detect and alert on patterns of failures