Production checklist

• HTTPS on site and API
• mxheadless_debug=false
• mxheadless_enabled=true (or a deliberate kill switch)
• CORS: specific origins, no * + credentials
• mxheadless_trusted_proxies set behind load balancer
• Rate limit enabled. Set per-key limits if needed
• Swagger: disable UI on the public internet (mxheadless_swagger_enabled=false) if external docs are not needed (OpenAPI JSON may still be reachable)
• Enable OAuth only when needed. Keep the password grant off
• Webhooks: allow_private_urls=false. Run the worker in cron
• Enable audit for compliance. Configure prune
• Keep key secrets out of git. Follow a rotation procedure
• Friendly URLs / rewrite verified with curl health + resources