SKILL.md
Anthropic Production Checklist
Overview
Before going live with a Claude-powered app, verify every item below.
Authentication & Security
- API key stored in secrets manager (not in code or env file on disk)
- Key rotated — not the same one used during development
- Server-side only — no key exposed to client/browser
- Per-user rate limiting in place
- Input validation: max length, content filtering
- System prompt includes injection guardrails
Output
- All checklist items verified (authentication, error handling, streaming, cost, monitoring, reliability, content, performance)
- Production API key configured with appropriate spending limits
- Monitoring and alerting in place
- Fallback behavior tested for API outages
Error Handling
- All Anthropic API calls wrapped in try/catch
-
RateLimitError(429) → backoff and retry -
OverloadedError(529) → fallback model or queue -
AuthenticationError(401) → alert team, don't retry -
InvalidRequestError(400) → log and fix, don't retry - Network errors → retry with backoff
- Request IDs logged for every error (for support tickets)
