Production Checklist

Security checklist before going live

Required Checklist

App Settings

Web server URL → Set to your actual production domain (HTTPS)
google-services.json → Replace with the production Firebase project file
assets/config.json → Confirm settings are correct for production environment

License

Dashboard → App Settings → Package name registered
Release keystore signature hash registered
Production license activated
app/src/release/assets/license.key file replaced with the latest file

Security Settings (`assets/config.json`)

Confirm screenshot protection setting (security.screenshotProtectionEnabled)
Confirm background screen protection setting (security.backgroundProtectionEnabled)
Root detection enabled (security.rootDetectionEnabled: true)

assets/config.json (security section)

{
  "security": {
    "screenshotProtectionEnabled": true,
    "backgroundProtectionEnabled": true,
    "rootDetectionEnabled": true
  }
}

For finance, healthcare, and payment apps, screenshotProtectionEnabled: true is recommended. It blocks screenshots and screen recording.

App Integrity

Google Play Console → App Integrity → Play Integrity API activation complete
Google Cloud Console → Play Integrity API enabled for the project

For details, see the App Integrity Check document.

Android Permissions (AndroidManifest.xml)

Uncomment only the permissions required by the bridges you use

Feature permissions (CAMERA, RECORD_AUDIO, ACCESS_FINE/COARSE_LOCATION, USE_BIOMETRIC, etc.) ship commented out in the manifest. Uncomment only the ones matching the bridges you actually use. Declaring permissions you do not use forces you to report unnecessary items in the Google Play Data Safety section. INTERNET, POST_NOTIFICATIONS, and VIBRATE are active by default.

Google Play Distribution

App signing: Google Play App Signing recommended
- If used: re-activate production license with the Google re-signing certificate hash
- Play Console → App → App Integrity → App signing certificate SHA-256 fingerprint
Upload as AAB format (avoid APK)
Confirm app version (versionCode, versionName)

# Build AAB for each flavor
./gradlew :app:bundleBasicRelease
./gradlew :app:bundleStandardRelease
./gradlew :app:bundleProRelease

Production package name registered in each social SDK's developer console
social_login_config.json keys are set for the production environment
If using Meta: build.gradle.kts manifestPlaceholders confirmed

iOS (App Store)

Info.plist Usage Descriptions

Confirm that the usage-description keys for the features you use are present in Info.plist.

NSCameraUsageDescription (camera / QR scanning)
NSFaceIDUsageDescription (biometric auth / Face ID)
NSLocationWhenInUseUsageDescription (location)
NSMicrophoneUsageDescription (microphone / speech)
NSPhotoLibraryUsageDescription / NSPhotoLibraryAddUsageDescription (photo library)
NSSpeechRecognitionUsageDescription (speech recognition)

Include only the keys for the features you actually use, and write each string to describe the purpose truthfully and clearly. Adding usage strings for permissions you do not use, or vague purposes, can lead to App Store review rejection.

Signing & Distribution

App Store signing / provisioning profile configured (distribution certificate, App ID)
StoreKit 2 in-app products configured — products registered in App Store Connect (if using in-app purchases)
(Note) The SDK's xcframework bundles dSYMs, so Validate App during App Store upload won't raise symbol warnings — no action needed

Google Play App Signing Notes

When you use Google Play App Signing, Google re-signs the app. At that point, the SHA-256 of your uploaded keystore differs from the SHA-256 of Google's re-signing certificate.

When activating the production license, you must use the SHA-256 of Google's re-signing certificate.

Play Console → App → App Integrity → App signing certificate section
Copy the SHA-256 certificate fingerprint
Dashboard → App Settings → Update app signature hash
Re-activate the production license

Production Checklist

On this page