Skip to main content

Checklist

Before going live, verify:
  • All API keys are in environment variables (not hardcoded)
  • .env is in .gitignore
  • Documents are indexed in Pinecone
  • Supabase tables exist (created automatically on first run)
  • Server uses SUPABASE_SERVICE_ROLE_KEY (bypasses RLS)
  • Multiple workers configured (uvicorn --workers)
  • Health check endpoint responding at /health

Environment variables

In production, set environment variables via your hosting platform (not a .env file):

Uvicorn configuration


Docker deployment


Health checks

Use the /health endpoint for load balancer and uptime monitor health checks:
In Docker Compose:

API key rotation

For high-traffic deployments, use multiple OpenAI keys to stay within rate limits:

Monitoring

LangChat saves request metrics to Supabase automatically. Query them to monitor:

Supabase connection pooling

For high concurrency, use Supabase’s connection pooler (Transaction mode via port 6543):
Supabase handles connection pooling internally for the REST API (which LangChat uses via the Python client). No extra configuration needed.

Security

Never expose raw API keys. Always use environment variables or a secrets manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault). CORS is enabled for all origins by default (allow_origins=["*"]). To restrict in production:
Rate limiting — add rate limiting middleware to prevent abuse: