Production readiness

Go live with a recoverable integration.

Validate the editor flow, credential boundary, durable data model, delivery behaviour and operational recovery before production traffic.

01 · Security

Credentials and origins

Live token is stored in the CMS secret manager.No persistent token is present in frontend bundles, HTML, URLs or logs. Only required scopes were requested.Test and live credentials are separate. Every CMS origin is registered exactly.Protocol, hostname and port match the deployed editor. Picker bridge endpoints require editor login and CSRF.Session ownership is checked during redemption.

02 · Persistence

Content model

Artwork fields store provider, type, ID and rendition.Collection fields do not store a rendition. Temporary URLs and Picker capabilities are never persisted.Cached labels are treated as non-authoritative. References are resolved when content is reopened or rendered.The selected rendition is passed through unchanged. Publication validates availability when required.Editors receive a useful message for unavailable content.

03 · Delivery

Assets and rights

Signed URLs are requested close to use.Expiry is honoured and URLs are not copied into permanent CMS content. Logical versions are joined with version_key.The physical response variant is never stored as the artwork rendition. Rendering uses the selected version's delivery facts.Width, height and MIME type come from the matching available_versions[].delivery object. Partial asset denial is handled per item.Missing and restricted variants do not break unrelated artwork. Rights and credit requirements are rendered from current data.The CMS does not infer permission from a cached file.

04 · Operations

Reliability and recovery

Every request is traceable.The CMS records status, problem code and request ID without recording secrets. Retries are bounded and idempotent.Picker redemption reuses a stable key after uncertain responses. A content refresh strategy exists.Sync cursors are committed transactionally and/or webhook events are deduplicated. Credential rotation has been rehearsed.A replacement can be deployed before the previous credential is revoked.

Final verification

Run both demos, then test your own bridge.

Complete one selection, change its version, cancel a second selection, retry a redemption, resolve the saved reference and simulate an unavailable result.

Open CMS demo ↗ Review failure handling →