*REST API › Guides*

# Going live checklist

> Go through these eight checks before your integration runs against production data. Each one points to the guide that explains it.

1. **One key per integration, with the minimum scopes** Create it from a dedicated administrator account that will outlast any one person, and keep it in a secrets manager. The key and every OAuth connection act as the administrator who created them, and stop with 401 [`api_key_owner_inactive`](https://docs.filmo.io/rest-api/errors/api_key_owner_inactive) or [`api_key_owner_not_admin`](https://docs.filmo.io/rest-api/errors/api_key_owner_not_admin) if that person leaves or stops being an administrator. Neither a key nor an OAuth connection uses a seat of its own, but the administrator account does. A key does not expire unless you set an expiry date when you create it, and it does not expire from inactivity. To rotate one, create a second key, move the integration to it and revoke the first. See [how to generate a key](https://www.filmo.io/help/reference/integrations-and-api/create-an-api-key) and [Scopes](https://docs.filmo.io/rest-api/guides/scopes).
2. **Respect Retry-After and send an Idempotency-Key on writes** Wait for `Retry-After` on a 429, send an `Idempotency-Key` on every write, and follow the retry decision table. See [Rate limits](https://docs.filmo.io/rest-api/guides/rate-limits), [Idempotency](https://docs.filmo.io/rest-api/guides/idempotency) and [Errors](https://docs.filmo.io/rest-api/guides/errors).
3. **Handle responses that are not application/problem+json** A 413, 502 or 504 can come from the platform and carry no `code` and no `requestId`. Decide by the status and do not try to read a `code`.
4. **Tolerate unknown properties and enum values** Clients generated with closed enums break on the additive changes the version policy allows. See [Versioning](https://docs.filmo.io/rest-api/guides/versioning).
5. **Log, alert and subscribe** Log `X-Request-Id` on every call. Filmo generates it on the server, so you cannot choose it; when you contact support, send the `requestId` together with the approximate time of the request. Alert on 401 [`api_key_owner_inactive`](https://docs.filmo.io/rest-api/errors/api_key_owner_inactive) and [`api_key_owner_not_admin`](https://docs.filmo.io/rest-api/errors/api_key_owner_not_admin), and on the `Deprecation` and `Sunset` headers. Subscribe to the feed of the Changelog tab.
6. **Check the account's automations** Your writes fire the account's event workflows and you cannot suppress them per request. List the active workflows that start on an event or an entity, pause the ones that could reach a customer, and filter the others by `origin` to exclude `api`. A workflow that calls the API with a key is expected to escape Filmo's loop protection, so never leave one that writes back unfiltered. See [Testing](https://docs.filmo.io/rest-api/guides/testing).
7. **If you synchronize data, use the full-pass parameters** Pass the parameters that reveal records lists hide by default, take window boundaries from the server's time, and confirm with a GET before you delete anything on your side. See [Syncing data](https://docs.filmo.io/rest-api/guides/syncing-data).
8. **Review the capabilities and limits, and test** Read [Capabilities and limits](https://docs.filmo.io/further-reading/capabilities-and-limits) for the hard limits, then run the checks in [Testing](https://docs.filmo.io/rest-api/guides/testing).

## What the account needs

The API and MCP are included in any paid plan and are not an add-on. Some modules are: a resource behind an add-on answers 402 [`addon_required`](https://docs.filmo.io/rest-api/errors/addon_required) when the account does not have it, so handle that response for each resource you use. Only administrators can create keys or consent to an OAuth connection.

## A last check in production

Run [`GET /api/v1/account`](https://docs.filmo.io/rest-api/endpoint-reference/account/get-the-account) once with the production key. Confirm the account is the one you expect, that the key has exactly the scopes you planned, that the add-ons you need are listed, and whether the account is still in a trial ([`trial`](https://docs.filmo.io/rest-api/objects/account#response-trial)). The call also returns the version of the contract and the limits that apply to the key.

```bash
curl -sS "${FILMO_BASE_URL:-https://app.filmo.io}/api/v1/account" \
  -H "Authorization: Bearer $FILMO_API_KEY"
```

---

Canonical URL: https://docs.filmo.io/rest-api/guides/going-live  
Last updated: 2026-10-09