# Before you go live with customer credentials

> The checklist to run before real customers sign up. URIs, secrets, the subject column, resends, prompt=login, refusals, erasing, and HumanProof.

Source: https://docs.trustaige.com/customer-credentials/go-live

Run through this before real customers sign up.

- [ ] **Your redirect, post-logout and initiate login URIs** are registered
      exactly, on HTTPS.
- [ ] **The client secret** lives in your secret store, never in the browser or
      your repository.
- [ ] **`subject` is a unique column**, and sign-in matches customers by it: it
      is the `sub` in every ID token and stays the same across renewals. A
      credential's document number changes each time it renews, so don't key on
      it. Your own fields, email included, are yours to search however you like.
- [ ] **Your welcome email carries the claim link**, from your own domain.
- [ ] **Someone who signs up again before claiming** gets a new link for the
      subject you already stored (send `subject` with the offer). Ask for a new
      subject only when the hub answers `404 unknown_subject`; `409
      already_claimed` means they hold it already, so send them to sign in.
- [ ] **Sign-in sends `prompt=login`** after a sign-out or a refusal.
- [ ] **Refusals show your own wording**, never `error_description`.
- [ ] **Closing an account calls the erase endpoint**, and treats `404` as done.
- [ ] **Your server verifies the HumanProof token** before it saves a record or
      asks for a subject.

> **See it running:** [AIGE Labs](https://aigelabs.com) is the running reference: sign up there and
> every step of this guide happens in front of you.