Reference

Production checklist

The few things to check before an OpenOrange app serves production traffic.

Check these before your app serves production traffic. Rivet’s own checklists cover the rest.

Quickstart

Lock down tokens and secrets

CI deploys with a cluster token in RIVET_CLOUD_TOKEN that has only the scopes it needs. See Sign in. Pass secrets with --secrets-file or --secret, never in vars, which are part of the image.
Run at least two nodes
Objects then have a runner to wake on during a rollout.
```
orange deploy --node-count 2
```
Turn on monitoring

Send traces, metrics, and logs to your tools. See OpenTelemetry and Prometheus.
Note each build ID
orange deploy prints the ID of the build it rolls out. Note it, so you can roll back to it if a later deploy goes wrong. This rolls out that build again and builds nothing:
```
orange deploy --cluster <cluster> --pool <pool> --build <build-id>
```

Pass RIVET_ENDPOINT as a secret, raise RIVET_NODE_VERSION on every deploy, and upgrade the Rivet Engine before OpenOrange.

AI context Why each check matters, and the rest of the list

Written for LLMs and coding agents: every edge case, measurement, and known deviation. You do not need it to use the feature.

Clients that must not call your Durable Objects directly get Rivet tokens without an actor_gateway grant. See Who can call an object.
Self-hosted, RIVET_ENDPOINT holds a token, which is why it goes to the container as a secret.

Pick the size of the pool’s nodes with --machine-type.
WebSocket clients reconnect after a random wait when a socket closes with 1012. A deploy closes the sockets of each runner it replaces. See Runner churn closes the sockets.

Each deploy sets RIVET_NODE_VERSION to a higher number than the last one, so new and waking objects start only on the new runners. Without it, RivetKit logs an error at startup. Rivet Cloud sets it for you.
Upgrade the Rivet Engine before you upgrade OpenOrange. A new OpenOrange can bring a new RivetKit, which can need a newer Engine.