# Production checklist

## Before launch
- Use a strong APP_KEY and administrator password.
- Put the application behind HTTPS and force HTTPS at the reverse proxy/web server.
- Set production MySQL credentials with least privilege.
- Configure SMTP or a transactional email provider.
- Configure all payment webhooks to `/api/webhooks/payment/{gateway}` and test signatures.
- Create live Paystack, Monnify and Flutterwave credentials only after sandbox/UAT passes.
- Select and contract a BNPL provider; the app intentionally does not pretend one provider is universally available.
- Configure Google OAuth production redirect URI.
- Add a standards-compliant server WebAuthn library/provider to complete passkey signature attestation/assertion verification; never store biometric templates.
- Configure Google Maps key and restrict it to your production domains.
- Add social-platform publishing credentials only for TechShop-owned authorized accounts.
- Connect Merchant Center and verify product feed diagnostics.
- Ensure every GTIN is an actual manufacturer-issued identifier; do not invent GTINs.
- Configure VAPID keys and service worker if enabling browser push.
- Configure object storage/CDN for product media before high-volume use.
- Set upload size/type restrictions and malware scanning for user-supplied media.
- Add database backups, offsite retention, restore tests and monitoring.
- Put rate limiting/WAF rules in front of login, search, checkout, webhooks and media upload endpoints.
- Run accessibility, responsive, performance and security testing.
- Conduct PCI/payment review: card data must remain on gateway-hosted or compliant components.
- Add privacy, cookie, terms, returns, warranty and Nigerian consumer/data-protection policies.

## Recommended infrastructure
- Nginx or Apache + PHP-FPM 8.4
- MySQL 8 primary with automated backups
- Redis for sessions/cache/queues at scale (the packaged build defaults to PHP sessions)
- CDN/object storage for images/videos
- Reverse proxy/WAF and TLS
- Central logs + uptime monitoring

## Important limitation
No ZIP can include your secret credentials, merchant approvals, Google OAuth approval, social account permissions, BNPL contract, SSL certificate or DNS ownership. Those are environment-specific go-live requirements, not missing source code.