Production Checklist

Prepare Rivet Actors for production by reviewing authentication, persistence, scaling, observability, deployment, and recovery.

Deploy-time configuration (environment variables, node pools and graceful shutdown) lives in the self-host production checklist. This page covers application design: what to get right before writing the actor, not before shipping it.

Actors

Design Patterns

• Do not use god actors. Avoid putting all logic into a single actor type. See Design Patterns.
• Do not use actor-per-request patterns. Avoid creating a new actor for each request. See Design Patterns.

Lifecycle

• Do not rely on onSleep for critical cleanup. onSleep is not called during crashes or forced terminations. See Lifecycle.

State

• Verify c.state does not grow unbounded. Avoid using arrays or objects that grow over time in state. Use SQLite for unbounded or append-heavy data instead.
• Use input parameters and createState for actor initialization. See Input Parameters.

Events

• Use conn.send() instead of c.broadcast() for private events. c.broadcast() sends to all connected clients. Use conn.send() to send events to a specific connection. See Realtime.

Actions

• Review action timeout configuration. The default actionTimeout is 60 seconds. Increase it if you have long-running actions like API calls or file processing. See Actor Configuration.
• Review message size limits. The default maxIncomingMessageSize is 64 KiB and maxOutgoingMessageSize is 1 MiB. Increase if your actors send or receive large JSON payloads. See Registry Configuration.

Queues

• Review queue limits. The default maxQueueSize is 1,000 messages and maxQueueMessageSize is 64 KiB. Increase if you expect burst traffic or large queue payloads. See Actor Configuration.
• Ensure queue handlers are idempotent. If processing fails before message.complete(), the message will be retried. See Queues.

Workflows

• Verify workflows do not generate infinite steps. Use ctx.loop to avoid creating unbounded step histories. See Workflows.

Security

Authentication

• Validate connections in createConnState or onBeforeConnect. Do not trust client input without validation. See Permissions.

CORS

• Configure CORS for production. Restrict allowed origins instead of allowing all. See CORS.

Tokens

• Keep your Rivet token server-side. Put it in RIVET_ENDPOINT only. Never expose it in client-side code, public repositories, or browser environments.
• Give browser clients scoped tokens. Issue scoped tokens from your backend. See Endpoints.

Access Control

Access control is only needed if you want granular permissions for different clients. For most use cases, basic authentication in onBeforeConnect or createConnState is sufficient.

• Use deny-by-default rules. Reject unknown roles in onBeforeConnect, action handlers, canPublish, and canSubscribe. See Permissions.
• Authorize actions explicitly. Check the caller’s role in each action handler and throw forbidden for unauthorized access.
• Gate event subscriptions and queue publishes. Use canSubscribe and canPublish hooks to restrict which clients can subscribe to events or publish to queues.

Clients

• Dispose connections and/or client when not in use (JavaScript client). Call conn.dispose() or client.dispose() when no longer needed to free resources. React and SwiftUI clients handle this automatically. See Connection Lifecycle.