6. Go-live checklist

• API key and signing secret in a secrets manager, never in the app or in git
• The token endpoint returns tokens only for the logged-in user's own tenant, with exp ≤ 15 min
• Webhook signatures verified, event_id de-duplicated, 2xx returned before heavy work
• Idempotency-Key on every POST
• Push credentials uploaded; device tokens registered on login and deleted on logout
• Tenant settings match your model (team_view, monitoring.modes, recording retention)
• Each WhatsApp number forwarded from your Meta webhook, or its direct webhook set up by the operator
• A test call per line, inbound and outbound, with audio both ways
• You know how to rotate keys: issue a new key, switch to it, revoke the old one (Keys)

7. Limits and current gaps

Area	Today
Rate limit	1200 API requests per minute per consumer
Agent tokens	Must expire; revoking a signing key disconnects every socket that used it
SDKs	Not published to npm or pub.dev yet: depend on them from the Calloop repository
Dart SDK on iOS	The native call screen (native_calls.dart) is Android only; on iOS, handle PushKit/CallKit in your app
SIP	IP-authenticated trunks only (no registration), UDP/TCP (no TLS yet), the carrier must send an SDP offer in the INVITE
Personal lines	No call waiting, voicemail, forwarding or user-to-user calls
Recording	Whisper and barge on a recorded call need a room (a tenant allowing them gets rooms); recording can't start partway through a call