Production checklist
OpenAI production checklist: 5 checks before launch
5 checks for running OpenAI in production: 1 must-do, 2 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (1)
Call the API from your server only; never ship the key to clients
A key in a browser or mobile bundle gets scraped and billed to you.
Verify from the command line
Build the app, then search the client output; a pass finds no key. No variable holding the key should start with NEXT_PUBLIC_ or VITE_.
grep -rnE "sk-[A-Za-z0-9_-]{20,}" .next/static dist build 2>/dev/null
Should do (2)
Set project budgets and per-user rate limits
One abusive user or a retry loop can burn your monthly budget in hours.
How to verify
In the OpenAI dashboard, set a budget with an alert in your project’s limits settings. Then call your own AI route quickly several times as one user; your app should answer 429 after its per-user limit.
Treat model output as untrusted input
Text a user or a web page feeds the model can override your instructions; never let output run tools, queries or HTML unchecked.
Check the code
Model output is escaped before it’s rendered (no dangerouslySetInnerHTML on raw output), and tool calls that change data need an allow-list or a user’s confirmation.
Good to have (2)
Retry 429s with exponential backoff
Rate limits are normal under load; fail gracefully instead of erroring.
Check the code
The official SDKs retry 429s and server errors twice by default; check you haven’t set maxRetries to 0 and that your UI shows a friendly message when retries run out.
const openai = new OpenAI({ maxRetries: 2, timeout: 60_000 });Moderate user content where your terms require it
The moderation endpoint flags harmful text and images before you store or show them.
Check the code
Where your terms need it, user input (or model output) goes through the moderation endpoint before you store or show it.
await openai.moderations.create({ model: 'omni-moderation-latest', input: text });
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.