In the dashboard
1
Isolation is signed
Isolation tab. It decides which column says whose data a row is. Read it once more: it is what keeps one customer out of another’s rows.
2
Allowed origins are your production origins
Doors tab. List each origin your customers use: a scheme and a host, no path, such as
https://app.example.com. Remove local origins you no longer need.3
Caps are set
Limits tab. A monthly cap for the assistant, and one per end customer. When a cap is reached, the assistant answers with a short message instead of disappearing.
4
Credits are there
Every question is charged to your workspace. With no credits left, the assistant degrades to a short message.
5
The assistant is published
The publish dialog lists what is still missing.
In your code
1
The API key is on the server only
In an environment variable. Not in front-end code, not in a mobile app, not in the repository.
2
The partition comes from your session
partitions: { customer_id: req.user.customerId }, never from the request body, a query string or a header the browser sets.3
Tokens renew
onSessionExpired is set. Leave a tab open 20 minutes, then ask a question: it must answer.4
Account deletion erases the conversation
conversations.erase runs when a customer deletes their account. See Conversations.5
Your CSP allows the Concatflow origin
In
script-src and frame-src. See CSP.