Production checklist

What has to be true before your integration touches a real person's data. Some steps are yours, some are Norvya's, and some belong to the practice or programme whose members you serve.

1. Finish in the sandbox

• Every call you will make in production answers in your sandbox (client ids start nvy_sbx_). Same base URL, token endpoint and scopes; the credential decides the environment, and a sandbox credential can never reach live data or the reverse.
• Your client handles 401 (fetch a new token: tokens last about 15 minutes), 403 insufficient_scope, 404 for members who are not yours, 409 gates, and 429 with Retry-After. The production limit per client is higher than the sandbox's but finite. Errors & limits
• Your retries follow the idempotency rules, and your webhook receiver verifies signatures, rejects stale timestamps and de-duplicates on Norvya-Delivery. Webhooks
• You store member_ref values as opaque strings scoped to your organisation, never as a cross-partner identifier.

2. Agreements

• Business associate agreement. Required before protected health information is exchanged. The partner gate opens only for an organisation with a BAA on file (signed in the app or recorded by Norvya); a demo exemption never counts.
• Your market's own steps, listed under “Before production” on your solution page and on each family page. For example: a state immunization registry connection with an attested data-exchange agreement; NSSP syndromic onboarding; registration with each EHR vendor's programme for SMART launch and CDS Hooks; a licence for licensed measures and instruments. A family marked Built — gated stays off until its step is done.

3. Production credentials

• Your production client is created in Norvya by the organisation's administrator (or by Norvya), with the scopes your product needs and no more. The secret is shown once; Norvya stores only a hash. EMR vendors get one vendor credential from Norvya, then each practice approves it and chooses the scopes it allows.
• Before the first production client is issued, Norvya fixes the key that derives every partner's member_ref values (PSEUDONYM_SALT) and does not rotate it afterwards, so the references you store stay stable. This is an operator step on Norvya's side: ask us to confirm it is done before you go live.
• Keep the secret in your server's secret store. Never put a production token in a browser, a mobile app or a shared Postman workspace; the portal's “Try it” panel refuses production tokens for that reason.

4. Cut over

• Swap the client id and secret; nothing else changes. Member references differ between the sandbox and production, so do not carry sandbox member_ref values over.
• Register production webhook endpoints separately (each gets its own secret) and watch GET /v1/usage for your first days of calls.
• Subscribe to the changelog (RSS) for behaviour changes.