# Checklist before saying it works

- [ ] `@finbaze/embed-react` is installed; no secret key appears in client code or `NEXT_PUBLIC_` variables.
- [ ] `app/api/finbaze/session/route.ts` exists, checks the partner's sign-in and returns a new client secret on every call.
- [ ] `components` in `createEmbedSession` lists every component the page mounts, with camelCase keys.
- [ ] The provider wraps the signed-in part of the app once; components are in client components.
- [ ] Views have a parent with a height; elements sit inline.
- [ ] The page's origin is an allowed origin in the developer portal (sandbox and live are separate).
- [ ] The user has access to the company (`setPlatformUserAccess`).
- [ ] For filing: the company's admin has given consent in `onboarding` or `tax-authorisation`.
- [ ] Opening the page shows the component and the browser console has no `FinBazeEmbedError` (see `/reference/errors`).