evernote-prod-checklist

name	evernote-prod-checklist
description	Production readiness checklist for Evernote integrations. Use when preparing to deploy Evernote integration to production, or auditing production readiness. Trigger with phrases like "evernote production", "deploy evernote", "evernote go live", "production checklist evernote".
allowed-tools	Read, Write, Edit, Grep
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
compatible-with	claude-code, codex, openclaw
tags	["saas","evernote","deployment","golang","audit"]

Evernote Production Checklist

Overview

Comprehensive checklist for deploying Evernote integrations to production, covering API key activation, security hardening, rate limit handling, monitoring, and go-live verification.

Prerequisites

• Completed development and testing in sandbox
• Production API key approved by Evernote (requires review process)
• Production infrastructure provisioned

Instructions

API Key & Authentication

• Production API key requested and approved by Evernote
• EVERNOTE_SANDBOX=false in production config
• Consumer key and secret stored in secrets manager (not env files)
• OAuth callback URL uses HTTPS on production domain
• Token expiration tracking implemented (edam_expires)
• Token refresh/re-auth flow tested end-to-end

Security

• Access tokens encrypted at rest (AES-256-GCM)
• CSRF protection on OAuth flow
• API credentials not in source control (.env in .gitignore)
• Log output redacts tokens and PII
• Input validation on all user-supplied content (ENML sanitization)
• Rate limit handling prevents API key suspension

Rate Limits & Performance

• Exponential backoff on RATE_LIMIT_REACHED errors
• Minimum delay between API calls (100-200ms)
• Response caching for listNotebooks() and listTags() (5-10 min TTL)
• findNotesMetadata() used instead of for listings