Product Guide

Guide

Everything you need to know about Signal shoot

On this page

What is Signal shoot Features Pricing Getting Started Setup Guide AI Setup API Reference Troubleshooting Go-Live Checklist Data Policies Security FAQ

Production Checklist

Before releasing your app with Signal shoot, verify each item below. These are the most common causes of production issues.

API Keys

Must use the live key (fb_live_), not the test key (fb_test_), in production buildsMust match the correct app in Settings after any key regenerationMust not be committed to public repositories. Store keys in environment variables or a secrets manager.

User IDs

Must be opaque (UUID/ULID/hashed). Must not be sequential integers that can be guessed.Recommended: omit user_id entirely if replies are not needed, to collect anonymous feedback

HMAC signing

Every request that includes user_id must carry the X-Signal-User-Id-Signature header. Compute HMAC-SHA256 using the signing_secret from Settings → Signing Key.After rotating the signing key, the previous key remains valid for a 7-day grace period. After that, only the new key is accepted.

Client-side security

Never ship live or test keys (fb_live_*, fb_test_*) in client-side JavaScript. For browser-only ingest, use a publishable key (fb_pub_*) with an Origin allowlist. If the request needs user_id or parent_id, it cannot use a publishable key — route it through your backend with a live key.Recommended: use opaque user_id even for mobile apps where the API key is embedded in the binary

Retry & duplicate prevention

Must disable the submit button until a response is received to prevent double-submissionMust not retry on 4xx errors. Retry only on network failure (timeout, no response).

Threaded conversations

Must only use IDs returned by a previous ingest response. Must not accept user-supplied or guessed values.Must handle 404 parent_not_found gracefully (e.g., fall back to creating a new feedback)

Monitoring

Recommended: log all non-200 API responses to detect integration issues earlyRecommended: monitor 429 monthly_limit_exceeded in API responses. It signals that the monthly limit has been reached — an upgrade indicator.

Signal shoot

Contact Guide Changelog Terms Privacy Commercial Disclosure Status