These notes cover production use of RPC PHP Toolkit endpoints.

Use method schemas for public methods. Invalid parameters should fail before business logic runs.

Keep sanitizeErrors enabled in production so internal exception details are not exposed to callers.

$rpc = new RpcEndpoint('/api/rpc', null, [
    'sanitizeErrors' => true,
]);

Use AuthMiddleware or application routing before dispatching to protected methods.

$rpc->getMiddleware()->add(new AuthMiddleware(function($token) {
    return validateToken($token);
}), 'before');

Avoid wildcard CORS for authenticated browser clients. Configure explicit origins and headers in production.

Use RateLimitMiddleware or an upstream reverse proxy to limit request volume.

Keep SSL verification enabled for clients. Disable verifySSL only in local development against self-signed certificates.

$client = new RpcClient('https://localhost:8443/api/rpc', [], [
    'verifySSL' => false,
]);

Do not use this setting in production.