General

1. Save your client_id and secret in your application server and creates a new session each time you initialize the SDK.
2. Handle webhooks and validate the HMAC signature to ensure the webhook comes from Knot.
3. Listen to client-side callbacks to monitor various events related to the user's lifecycle through the Knot SDK, including the refresh session request event to know when to call Extend Session if the user is still using the SDK.
4. Remove any user_good test calls to prepare for production.
5. Request production access and retrieve your production client_id and secret from your Customer Dashboard. Ensure your production keys are used and secured - never saved in source control or client-accessible.
6. Give the Knot team a heads up regarding your launch timeline.

CardSwitcher

1. When you receive the AUTHENTICATED webhook, call the Switch Card or Switch Card (JWE) endpoint from your backend, unless you are using the Unit integration.

Web

1. If you have not already, allowlist your production domain in your Customer Dashboard.