# Before You Go Live

> The checklist before an API Maker server takes real users - default passwords, the default API user and group, the row gate, public APIs, HTTPS, the licence key, backups and the sandboxes.

Source: https://docs.apimaker.dev/v4/docs/security/go-live.html

A new installation is set up for its first steps, not for real users. Go through this list before real data arrives, and again after a big change.

## Accounts and passwords

- [ ] **Change the passwords of the admin panel.** The install script creates `root@root.com` (`R00t_123456789`) and `admin@admin.com` (`Admin_123456789`) : change the first in **Root Settings**, the second in its profile.
- [ ] **Turn on [two-factor sign-in](https://docs.apimaker.dev/v4/docs/features/security-features.html#two-factor-sign-in)** for the people of the admin panel.
- [ ] **Replace the API user `default`.** Its password is `12345`, in the secret (`common.apiUserPasswords.default`). Give each application an [API user](https://docs.apimaker.dev/v4/docs/apis-security/api-user-permission.html) of its own with a long password, and delete `default` or change its password.

## Who reaches what

- [ ] **Replace the group `Default`.** It grants everything. Make small [groups](https://docs.apimaker.dev/v4/docs/apis-security/api-group-permission.html), one per screen or per job, with the tables, APIs and fields each needs, and no `allCollections` or `allSystemApis`.
- [ ] **Close the row gate.** Every table people reach through the generated APIs needs a [row scoping pre hook](https://docs.apimaker.dev/v4/docs/apis-all/hooks/preHook-api.html#narrow-a-request-to-the-rows-of-the-caller) : the owner in every filter, stamped on every write.
- [ ] **Run the [security report](https://docs.apimaker.dev/v4/docs/apis-security/api-security-report.html)** and fix or skip, with a reason, every finding. Aim for grade A.
- [ ] **Review what is public.** The APIs marked `IS_PUBLIC`, and the [system APIs](https://docs.apimaker.dev/v4/docs/settings/systemApiSettings.html) opened over HTTP : each one has a reason.
- [ ] **List the [allowed origins](https://docs.apimaker.dev/v4/docs/features/security-features.html#allowed-origins)** of your web apps, so browsers on other sites are refused.

## The server

- [ ] **HTTPS only.** Install with Caddy and SSL (`--ssl=yes` and your domains, see [Install on a server](https://docs.apimaker.dev/v4/docs/getting-started/install-on-server.html)), so tokens never travel in clear.
- [ ] **Set your licence key.** The key of API Maker Launchpad is for development on a computer.
- [ ] **Keep the databases private.** Your databases, and the MongoDB and Redis of API Maker, answer on a private network or on the server itself, never on the internet.
- [ ] **Back up.** The MongoDB of API Maker (`mongodump`), your own databases, and `/root/config/.env` with `license.txt` : a backup you have restored once is the one you can trust.

## Your code

- [ ] **Run only code you trust on the server.** The sandboxes stop faulty code, not hostile code : read [what they protect](https://docs.apimaker.dev/v4/docs/security/overview.html#sandboxes). For clients who must not see each other's data, use separate servers.
- [ ] **Keep secrets in the secret.** No key or password written in the code : the [code scan](https://docs.apimaker.dev/v4/docs/apis-security/api-security-report-reference.html#the-code-scan) of the report finds them.
- [ ] **Run the [test cases](https://docs.apimaker.dev/v4/docs/test-cases/test-cases.html)** : `npm run test` in the folder of the local client.

## Related

- [Security overview](https://docs.apimaker.dev/v4/docs/security/overview.html) · [Handle role based permissions](https://docs.apimaker.dev/v4/docs/authorization/handle-role-based-permissions.html) · [Secrets](https://docs.apimaker.dev/v4/docs/secrets/secrets.html)