# Ship to production (/ship)
Moving from `cuelo dev` to production comes down to three things: **lock it
down**, **size it**, and **run it close to your providers**.
## The checklist [#the-checklist]
| | Step | Why | Page |
| --- | ------------------------------------------ | ------------------------------------------------------------------------------------- | ------------------------------------ |
| 1 | Set `serve.api_keys` | The server refuses a public host without them, and they protect calls and recordings. | [Security](/ship/security) |
| 2 | Set `serve.cors` for browser apps | Browsers on other origins are blocked by default. | [Security](/ship/security#cors) |
| 3 | Run `cuelo machine check` | Real-time capacity depends on the turn-taking stack and your CPU. | [Deploy](/ship/deploy#measure-first) |
| 4 | Set `serve.workers` | One process uses about 4 cores, so add workers beyond that. | [Deploy](/ship/deploy#serve) |
| 5 | Move the store to Postgres or MySQL | SQLite is per machine. | [Storage](/observe/storage) |
| 6 | Put TLS in front and allow long WebSockets | Browsers need `wss://` for the mic, and idle timeouts must exceed call length. | [Deploy](/ship/deploy#checklist) |
| 7 | Bake model weights into the image | The first call shouldn't wait on a download. | [Deploy](/ship/deploy#container) |
| 8 | Deploy near your providers | Network round trips are a large share of latency. | [Deploy](/ship/deploy#checklist) |
## In this section [#in-this-section]
API keys, CORS, credentials and call data.
Sizing with `machine check`, workers, a container and a production checklist.