> ## Documentation Index
> Fetch the complete documentation index at: https://docs.botshield.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Go to production

> Four steps unlock production: a verified domain, business verification, a Developer passkey and a plan. Free covers your first production gate.

Development is on from the moment you sign up. It is not billed and needs nothing. Production needs four things, and the Console's dashboard walks you through them in a **Go to production** card.

| Step | What it proves | Where |
| - | - | - |
| **1. Verify your domain** | The site is yours. One TXT record. | Dashboard, or **Settings → Developer Tools** |
| **2. Submit your business for review** | A real business stands behind the gates. | Dashboard |
| **3. Create your Developer passkey** | A real person confirms each production change. | Dashboard, or **Settings → Profile** |
| **4. Pick a plan** | Free covers your first production gate. | **Settings → Plans** |

Until all four are done, your Development gates and keys keep working as usual.

## 1. Verify your domain

Add your root domain, for example `meridianairlines.com`. The Console shows a TXT record with a **name** and a **value**. Add it at your DNS provider, then select the check. A new record can take a few minutes to show up.

A verified domain does two things:

* **It unlocks production gates.** Activating a Production gate needs at least one verified domain on your organization.
* **It bounds your live site keys.** Every allowed origin on a `pk_live_` key must sit under a verified domain: the root itself, or any subdomain of it. `https://www.meridianairlines.com`, `https://checkout.meridianairlines.com` and `https://*.meridianairlines.com` are all under `meridianairlines.com`. Test keys (`pk_test_`) are exempt, so you can build before your domain is verified.

If you save a live key with an origin outside your verified domains, the Console names the origin and refuses the save, for example "shop.example.net isn't on a verified domain (meridianairlines.com). Verify it first, or use a test key."

## 2. Submit your business for review

Enter your legal name, EIN, website and intended use. A person reviews it, usually within a day. Your Development environment keeps working while the review is open. If BotShield needs more, the step says so.

## 3. Create your Developer passkey

Your **Developer passkey** is a passkey on your own Console account. Every production change is confirmed with it, at the moment you make the change: BotShield asks for a fresh confirmation when your last one is more than 5 minutes old. That includes:

* Placing and activating a Production gate, and changing a Production gate's settings, including [Who may pass](/gate/who-may-pass).
* Revoking or rotating production keys.

Only someone holding the passkey can make these changes. Development changes never ask for it.

## 4. Pick a plan

Every organization starts on **Free**, and Free covers your first production gate. Pick a paid plan when you need more production gates. Development gates are never limited. Draft and Active production gates count toward the limit; Archived ones do not.

## When Activate is refused

**Activate** on a Production gate checks the steps in this order and stops at the first one that is missing:

| Code | Message | Fix |
| - | - | - |
| `org_not_verified` | Business verification required before activating a production deployment. | Finish step 2. |
| `domain_not_verified` | Verify your domain before activating a production gate. One TXT record proves the site is yours. | Finish step 1. |
| `gate_limit_reached` | Your Free plan includes 1 production gate. Upgrade in Settings → Plans to place more, or archive one you no longer use. | Pick a larger plan, or archive a gate. |
| `passkey_required` | A console passkey is required for production. Add one under Settings → Profile → Passkeys, then try again. | Finish step 3. |
| `passkey_stepup_required` | Confirm with your console passkey to continue — the confirmation must be from the last 5 minutes. | Confirm with your passkey, then select **Activate** again. |

The domain is checked before the passkey, so you are never asked for a passkey only to be refused. Placing a Production gate can return the two passkey codes and the plan limit.

<Note>
  **Gates and keys already live keep running.** These checks run when you place, activate or save. They never run when a person passes a gate. A Production gate that was active before you verified a domain stays active.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Place a gate" icon="location-dot" href="/gate/place-a-gate">
    Place and activate the Production gate.
  </Card>

  <Card title="Testing" icon="flask" href="/gate/testing">
    The pre-launch checklist.
  </Card>

  <Card title="Keys and environments" icon="key" href="/console/keys-and-environments">
    Site keys, API keys and the two environments.
  </Card>

  <Card title="Who may pass" icon="sliders" href="/gate/who-may-pass">
    Set the levers before you launch.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.