Production checklist

What production teams need before sending real documents on Seal

Production checklist

For teams on seal.nyc (hosted) or a serious self-host. Agents and humans both use this as the “are we ready?” gate. Agents run the sender side via OpenAPI; recipients (humans) sign. See Agents & who signs.

Golden path (must work)

1. Create workspace
2. Create API key (seal_…) with document + recipient write scopes
3. Upload PDF → add recipient → send (agent / API / MCP)
4. Recipient opens signing link → human signs
5. Webhook (or poll) sees document.completed
6. Audit log shows the trail

Hosted golden path (from the repo — CLI + public signing half → completed → audit):

SEAL_API_KEY=seal_… pnpm run prove:golden-path
# self-host:
SEAL_API_KEY=seal_… pnpm run prove:golden-path \
  --api https://seal-selfhost-api.<account>.workers.dev \
  --app https://seal-selfhost-web.<account>.workers.dev

Alternate raw HTTP smoke (no CLI):

SEAL_API_KEY=seal_… node scripts/smoke-prod.mjs
# self-host:
SEAL_API_KEY=seal_… node scripts/smoke-prod.mjs --api https://seal-selfhost-api.<account>.workers.dev

API keys

• Prefer least privilege scopes; rotate by creating a new key and revoking the old
• Plaintext token is shown once at create — store it in your secret manager
• Revoked keys must fail immediately on the next request

Webhooks

• Configure an HTTPS endpoint before you send production volume
• Verify signatures on every delivery (Webhooks)
• Treat delivery as at-least-once — make handlers idempotent
• Alert on sustained delivery failure (check Analytics / webhook status)

Audit & compliance

• Signing events write an audit trail (view / sign / complete)
• Export or retain audit according to your policy — do not rely on UI alone for legal hold without verifying retention for your plan

Email

• Hosted Seal sends from Vortex-managed senders
• Self-host: you must configure Email Routing / verified EMAIL_FROM or invites will not leave the box (Self-host)

Auth & sessions

• Enforce 2FA for operators (Profile → Security)
• Review active sessions after staffing changes
• Prefer org-scoped API keys over browser sessions for automation

Money / invoices (if you collect payment on documents)

• Amounts are integer minor units — never float math in your integration
• Prefer Seal’s payment config + Stripe path; do not reimplement fee allocation in the client

Ops

Self-host extras

Follow Self-host on Cloudflare first, then this checklist against your origins.