Go live

Before launch

• Hardware keys. secureArea = HARDWARE in production; SOFTWARE is for emulators and tests.
• Reader trust. A signed reader list (RICAL) or reader root certificates, so the consent sheet names verifiers. Unknown verifiers are shown as unknown; the holder can still decline.
• Issuer configuration for the real authority’s OpenID4VCI endpoint.
• Entry points registered and agreed with the sites you work with: App Link hosts, your Universal Link domain and its association file, the iOS provider extension (Present).
• Card designs for every document type you hold; others fall back to the neutral card.
• Face check (Prove it’s you) for the credential types that need it: the model file shipped with the app, NSCameraUsageDescription on iOS (plus FaceCheckHostViewController() if you built your own screens), the threshold tried with real holders.
• Store listing. Android: package name and signing certificate fingerprint go into every site’s assetlinks.json. iOS: bundle id and team go into every site’s association file.
• Test issuance, in-person presentation to the Verify app, a website link on the same phone, and the system ID sheet.

After launch

• A new signing certificate or bundle id breaks every App Link and Universal Link; plan rotations with the sites.
• Keep the SDK version aligned with the verifiers you work with when you update.

Next: Credentials for the document types, and Trust.