# Production Test

A short checklist for validating API access after deploying Restory and syncing Autumn features.

## Fast links

- Web page: https://www.restory.pics/agent/docs/production-test
- Markdown: https://www.restory.pics/api/agent/docs/markdown/production-test
- Capabilities JSON: https://www.restory.pics/api/agent/capabilities
- OpenAPI JSON: https://www.restory.pics/api/agent/openapi
- API keys: https://www.restory.pics/agent

## Before testing

Confirm the Supabase migration is deployed, `RESTORY_API_KEY_PEPPER` is set, and Autumn has `ai-agent-api-access` or an allowed Pro/Ultra product ID on Pro, Pro Yearly, Ultra, and Ultra Yearly products.

## Create a key

Sign in as a Pro or Ultra user, open `/agent`, create a key, and copy the one-time secret.

## Smoke checks

```bash
export RESTORY_API_KEY="rst_..."
curl -sS https://www.restory.pics/api/agent/credits \
  -H "Authorization: Bearer $RESTORY_API_KEY"
```

## Failure cases

Starter users should receive a 403 when creating keys. Revoked keys should receive 401. Downgraded users should be blocked from API-key authenticated workflows.