Go-live checklist

Updated: 2026-08-21 02:20

• Intended country, currency and products are enabled for the merchant.
• Test environment integration, failure cases and merchant-order queries have passed before production enablement.
• The fixed production outbound IPs are approved in the platform security group, WAF or API Gateway.
• The live-mode API Key has been created and enabled in Portal; required Webhook endpoints are created separately.
• amount.value remains a decimal string and respects the selected productCode currency precision and limits.
• API and Webhook Secrets are stored only in a backend secret manager.
• Each required HTTPS Webhook endpoint has the correct event subscriptions and is enabled independently from the API Key.
• Every request uses a fresh nonce and current Unix timestamp text.
• merchantOrderNo is persisted before every create request.
• No business create request is automatically retried.
• HTTP 200, HTTP 4xx, HTTP 5xx, timeout and network-loss flows are tested; uncertain create results are queried by the original merchantOrderNo.
• If repeated queries still find no order, only the same merchantOrderNo and unchanged request are resent, and never concurrently.
• The Webhook receiver returns HTTP 200 OK after the event is stored or processed; any other 2xx is also treated as successful receipt by the platform.
• Merchant order numbers, platform order numbers, Request-Id and necessary response details are retained.
• Webhook raw-body verification, timestamp checks and event deduplication pass.
• Balance and merchant-order query APIs were tested independently from Webhook delivery.
• Order-state decisions use status, Webhook events and query results consistently.
• Production rate expectations have been confirmed with platform operations.
• Logs and support exports redact API Secret, Webhook Secret, signatures and recipient details.
• The exact interface 1.0 OpenAPI, SDK release and Demo versions are recorded.

Run the signing golden vectors in the merchant deployment environment before enabling production traffic.