The MVP Handover Checklist: Code, Accounts, Keys and Docs You Must Receive

At delivery you must receive four things: the full code repository under an account you own, owner-level access to every account the product runs on, every secret key in a password manager you control, and a short set of documents that lets a stranger run the product without calling the agency. That is 24 concrete items, listed below, and you can verify all of them in about 40 minutes. If a single one is missing, you do not own your MVP yet, whatever the invoice says. This checklist is written for a non-technical founder about to pay a final bill, so every item comes with the plain-English reason it matters, a 10-minute way to check it, and what it costs to fix if it is absent.

Why the handover is where founders lose the most money

Most MVP disputes are not about code quality. They are about access. The product works, the demo went well, and three months later the founder discovers the domain renews to the agency's credit card, the database lives in a developer's personal account, and the payment keys were never written down. None of that shows up in a demo. It shows up when you try to leave, raise money, or hire your second developer.

The fix is cheap before the final payment and expensive after. Before payment, every missing item is a one-line request the agency has every reason to honor. After payment, each missing item is a favor, and if the agency has gone quiet it is a rebuild at $4,000 to $15,000 for a scoped MVP in 2026. The hour you spend on this checklist is the best-paid hour of the project. For the contract language that makes it enforceable, read what to put in a development contract.

Group 1: The code (6 items)

The code is the asset you paid for. It must arrive as a living repository, not a folder of files, and it must provably match what is running in production.

1. A Git repository transferred to an organization you own. On GitHub, GitLab or Bitbucket, the repository sits under an organization created with your email address, and your role is Owner. The agency may remain as a member you can remove. A zip file, a shared Google Drive folder or a repository under the agency's organization with you as "collaborator" all fail this item.
2. Full commit history. Every change the team made, with dates and messages, not a single "initial commit" dated the day of delivery. History is what lets the next developer understand why things are the way they are.
3. The live commit matches the repository. Your hosting dashboard shows which commit each deployment was built from. The latest deployment's commit must be the newest commit on your main branch.
4. No secrets inside the code. Passwords and API keys belong in environment variables, not in files. A quick search of the repository for words like "password", "secret" and "sk_live" should return nothing but placeholder names.
5. A one-command local build. The README states how to run the product on a laptop, and a developer who has never seen the project can do it in under an hour.
6. Any mobile build artifacts. For an app on the stores: the signing keystore for Android and the certificates and provisioning profiles for iOS, plus the passwords for them. Without the Android keystore nobody can ever publish an update to your app, only a new app.

The 10-minute check

Log in to the repository host with your own credentials, not a link the agency sent. Confirm the organization name is yours and your role reads Owner. Open the commit list and scroll: you want dozens of commits across the build period. Copy the short identifier of the newest commit. Open your hosting dashboard, find the latest production deployment, and compare. Then open the repository search box and type "sk_live" and "password". Ten minutes, and you have verified items 1 to 4.

Group 2: The accounts (8 items)

An MVP in 2026 depends on six to ten third-party services. Each one is an account, and each account has exactly one owner. If that owner is not you, the service can be cut off, repriced or deleted without your consent. The rule is simple: every account is opened with an email address you control, and the agency is invited in, never the other way round.

The 10-minute check

Open each service in a private browser window and sign in with your own email and password. Go to the billing page: the card on file must be yours. Go to the team or members page: your role must be Owner or Admin, and you must be able to see the agency's seat so you can remove it later. For the database, click the backup or export button and confirm a file downloads. For the domain, open the registrar and read the registrant contact. Eight services at roughly one minute each.

Group 3: The keys (5 items)

Keys are the passwords machines use to talk to each other: one for the database, one for payments, one for email, one for any AI model the app calls. They are not in the code (see item 4), so they must be handed over separately and stored where you control them.

1. A complete list of environment variables for production. Every name and every value, matching exactly what the hosting dashboard shows. Typically 8 to 25 entries for an MVP.
2. Every key stored in a password manager vault you own. 1Password Business or Bitwarden Teams costs $3 to $8 per user per month. The agency is given a shared vault, not the other way round.
3. Each third-party key created under your account. A Stripe key generated inside the agency's Stripe account is worthless to you. Each key must come from the account you verified in Group 2.
4. Admin credentials for the product itself. The first admin user of your own app, with a password you set after handover.
5. A rotation note. One line per key saying where to regenerate it. When a developer leaves, you rotate every key they ever saw; the note makes that a 30-minute job instead of a day.

The 10-minute check

Open the hosting dashboard's environment variables page and count the entries. Open the vault the agency shared and count again; the numbers must match. Pick two keys at random, such as the payment key and the database connection string, and confirm the value in the vault equals the value in the dashboard. Log in to the live product as admin and change the admin password yourself. If the agency objects to you changing a password on your own product, that is your answer about who owns it.

Group 4: The documents (5 items)

Documentation at MVP stage is short: five pages that stop a future developer from spending $2,000 of billable time rediscovering what the first team already knew.

1. README. What the product is, how to run it locally, how to run the tests, and how to deploy. One to three pages.
2. Architecture note. A diagram or a half-page of prose: which services talk to which, where the data lives, what runs on a schedule. The stack choices and the reason for each.
3. Environment and deploy guide. How a change goes from a developer's laptop to production, including any manual steps.
4. Known issues and deferred work. An honest list of what was cut from scope, what is fragile, and what the team would fix first with another week. Every MVP has this list; a team that says theirs is empty has not written it down.
5. Signed IP assignment and final invoice. The paper that says the code is yours, signed by someone authorized at the agency, plus the invoice marked paid. IP assignment is the item most founders assume is automatic. It is not; without a signed assignment, the default in most jurisdictions is that the creator keeps copyright.

The 10-minute check

Open the README and read the "how to run" section. You do not need to run it; you need to see that it exists and contains commands, not a sentence like "ask the team". Open the known-issues list and compare it with the acceptance criteria you agreed at the start. Open the IP assignment and look for three things: the agency's legal name, a signature, and a sentence assigning all rights in the deliverables to your company. If you never agreed acceptance criteria, the known-issues list is the only record of what "done" meant.

The printable version

Here is the full list in one place. Print it, or paste it into the message you send the agency the week before delivery. Items with a star are the ones that cannot be recovered without the agency's cooperation, so check those first.

What a missing item actually costs

Not every gap is a crisis. Here are realistic 2026 recovery costs at $60 to $120 per hour, the common range for a competent freelancer in the US or Western Europe.

• Missing or thin documentation (items 20-22): 4 to 8 hours for a new developer to reverse-engineer the setup, so $300 to $800. Annoying, not fatal.
• A key not handed over (items 15-17): 1 to 3 hours to regenerate and redeploy, if the account is yours. $100 to $300. If the account is not yours, see the next line.
• An account in the agency's name (items 7-14): Hosting and email can be rebuilt in a day, $500 to $1,000. The database cannot: if the users' data sits in an account you do not control, you either negotiate or start with an empty database.
• Repository never received (items 1-3): the full build price again. For a scoped MVP, $4,000 to $15,000 at a fixed-price studio; more at hourly rates, as the 2026 cost survey shows.
• No IP assignment (item 24): a lawyer's letter at $500 to $1,500 if the agency cooperates; a due-diligence problem that can stall a funding round if it does not.

The pattern is clear. Documentation gaps cost hundreds. Access gaps cost thousands or the whole project. So when time is short, check the starred items first and accept a thinner README if you must.

Red flags at handover, and what to do about them

Most agencies are disorganized rather than dishonest, and most gaps close with one polite email. These signals mean hold the final payment until the item arrives:

• "We'll transfer the repo after the final payment clears." Reverse it. Transfer first, pay the same day. A studio confident in its work loses nothing by doing it in that order.
• "The accounts are under our agency plan, it's cheaper for you." It is cheaper until you leave. Ask for a transfer or a fresh account in your name, and accept the $20 a month.
• "The keys are in the code, that's normal for an MVP." It is common and it is still wrong. Ask for them to be moved to environment variables before delivery, which takes an hour.
• "There is no known-issues list because there are no known issues." Ask what they cut from scope. If the answer is nothing, compare the delivery against the original spec yourself.
• A single commit dated delivery day. Either the history was squashed, which hides the work, or the code was copied from elsewhere. Ask for the original repository.

If the agency stalls on a starred item for more than a week, treat the project as at risk and read what happens if your agency misses the deadline for the escalation path. Asking clearly, in writing, before the final invoice resolves nine gaps out of ten.

How to make the handover a non-event

The best handover is one where nothing is transferred, because everything was yours from day one. Open the accounts yourself before the kickoff call, invite the team in, and have them push to a repository in your organization from the first commit. Delivery day is then a 40-minute walk through this list, not a negotiation. Only the IP assignment and the known-issues list still happen at the end, and both belong in the contract from the start.

At SquadPrime this is how every build runs. One fixed price from $4,000, agreed before the build starts; a private preview link you can click by day 5; and 100% of the code is yours on delivery, in a repository you own. If you are still pricing the build, the free MVP cost calculator gives you a number for your feature list in two minutes.

FAQ

What should I receive when my MVP is delivered?

Four groups of things: the code repository under your own account, owner access to every account the product runs on (hosting, domain, database, payments, email, app stores), every secret key stored in a password manager you control, and a short set of documents including a README, an environment variable list, a deploy guide and a signed IP assignment. If any group is missing, the handover is not complete.

Is a zip file of the code an acceptable handover?

No. A zip file has no commit history, no proof it matches what is running live, and no way for the next developer to see what changed and why. Insist on the full Git repository transferred to an organization you own on GitHub, GitLab or Bitbucket, with you as the owner and the agency, at most, as a collaborator you can remove.

Who should own the hosting and domain accounts for an MVP?

You should, from day one. Every account the product depends on is opened with an email address you control, usually a role address like admin@yourdomain.com, and the agency is invited as a member. If the agency opened an account in its own name, ask for an ownership transfer before you pay the final invoice, not after.

How do I check that the code I received is the code that is live?

Open the hosting dashboard and look at the latest deployment. It shows the commit identifier it was built from, usually a short code like a1b2c3d. Open your repository and confirm that the same identifier is the most recent commit on the main branch. If they match, you hold the live code. If they do not, ask the agency to push the missing commits before you sign off.

What does it cost if an item is missing from the handover?

It ranges from nothing to the price of the whole build. A missing README costs a few hundred dollars of a new developer's time. A payment key that was never handed over costs a few hours to rotate. A repository you never received, from an agency that stopped answering, can mean rebuilding from scratch, which in 2026 typically runs $4,000 to $15,000 for a scoped MVP.

All third-party names and trademarks belong to their respective owners and are used for identification only. Any market figures reflect our experience building MVPs and typical ranges as of October 12, 2026, and may change at any time. Spotted something outdated or inaccurate? Email talk@squadprime.com and we'll correct it promptly.

Related: Who owns the code when you hire a dev agency? · How to switch MVP developers mid-project without losing the code