Go-Live Checklist

Security

• [ ] Production API keys stored in secure environment variables
• [ ] Webhook signature verification implemented
• [ ] HTTPS enforced for all API calls
• [ ] No API keys in version control or client-side code
• [ ] Webhook endpoint uses HTTPS
• [ ] Input validation on all customer-facing endpoints

Payment Flow

• [ ] Test checkout flow with sandbox keys
• [ ] Implement payment status polling or webhook handling
• [ ] Handle all payment statuses (pending, completed, failed, expired)
• [ ] Generate unique idempotency keys for each transaction
• [ ] Display clear error messages to customers

Webhooks

• [ ] Webhook endpoint deployed and accessible
• [ ] Signature verification implemented
• [ ] Idempotent event handling (process events only once)
• [ ] Async processing (return 200 immediately)
• [ ] Error logging and monitoring

Payouts

• [ ] Verify sufficient wallet balance before payout
• [ ] Display fee breakdown to users
• [ ] Handle payout failures and reversals
• [ ] Implement refund logic for failed payouts

Monitoring

• [ ] Log all API requests and responses (without sensitive data)
• [ ] Monitor webhook delivery success rate
• [ ] Set up alerts for failed payments
• [ ] Track idempotency key usage