From navan-pack
Checklist for Navan API production readiness: credential security/rotation, OAuth verification, error handling/alerting, rate limits, SSO/SCIM, compliance audits.
How this skill is triggered — by the user, by Claude, or both
Slash command
/navan-pack:navan-prod-checklistThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Gated production readiness verification for Navan REST API integrations. Navan has no SDK and no sandbox — production is the only environment, making this checklist critical.
Gated production readiness verification for Navan REST API integrations. Navan has no SDK and no sandbox — production is the only environment, making this checklist critical.
curl and jq for verification commandsclient_id and client_secret stored in a secret manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault) — never in environment variables, config files, or source control# Verify current credentials work
curl -s -X POST "https://api.navan.com/ta-auth/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET" \
| jq '{authenticated: (.access_token != null), error: .error}'
Rotation procedure:
/ta-auth/oauth/token# Health check endpoint pattern
health_check() {
RESPONSE=$(curl -s -w "%{http_code}" -o /tmp/navan-health.json \
-X POST "https://api.navan.com/ta-auth/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET")
if [ "$RESPONSE" = "200" ]; then
echo '{"status":"healthy","navan_api":"reachable"}'
elif [ "$RESPONSE" = "429" ]; then
echo '{"status":"degraded","reason":"rate_limited"}'
else
echo "{\"status\":\"unhealthy\",\"http_code\":\"$RESPONSE\"}"
fi
}
Retry-After header and honor wait time# Verify users are synced via API
TOKEN=$(curl -s -X POST "https://api.navan.com/ta-auth/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET" \
| jq -r '.access_token')
curl -s -H "Authorization: Bearer $TOKEN" \
"https://api.navan.com/v1/users" \
| jq '{total_users: (.data | length), sample: .data[0] | {id, email, status}}'
A completed checklist with:
| Check Failure | Impact | Remediation |
|---|---|---|
| Credentials in plaintext | Critical — security breach risk | Move to secret manager immediately |
| No retry logic on 429 | High — cascading failures under load | Implement exponential backoff |
| SCIM not configured | Medium — manual user management overhead | Enable SCIM in IdP and Navan admin |
| No audit logging | High — compliance violation | Add structured logging to API client |
Run a quick pre-launch validation:
# Rapid smoke test — auth + user count + timing
echo "=== Navan Production Smoke Test ==="
curl -s -w "Auth: %{http_code} (%{time_total}s)\n" -o /tmp/navan-auth.json \
-X POST "https://api.navan.com/ta-auth/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET"
TOKEN=$(jq -r '.access_token' /tmp/navan-auth.json)
curl -s -w "Users: %{http_code} (%{time_total}s)\n" -o /tmp/navan-users.json \
-H "Authorization: Bearer $TOKEN" \
"https://api.navan.com/v1/users"
echo "User count: $(jq '.data | length' /tmp/navan-users.json)"
navan-upgrade-migration for ongoing API change managementnavan-observability for monitoring stack setupnavan-incident-runbook if production issues arise post-launchnpx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin navan-packSecures Navan API credentials with OAuth 2.0 storage/rotation in TypeScript/Node, plus SSO/SAML and SCIM setup for identity providers.
Reviews NetSuite sandbox and non-production environment governance: enforces OAuth 2.0 app re-authorization and TBA token isolation per environment, sandbox refresh impact, and production readiness checks.
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.