Going live
Go-live checklist
Use this checklist before switching production traffic to live credentials.
1. Credentials and access
- Create live API credential in merchant console.
- Store live key in your production secret manager.
- Confirm live key with
/v1/merchant/principal. - If using IP allowlists, add all production egress IPs/CIDRs and test from each environment.
- Enroll payout security (email OTP and/or payout authenticator) and verify a canary payout.
2. Webhooks
- Create live webhook endpoint under
/v1/webhooks/endpoints. - Store the one-time signing secret.
- Enable signature verification on raw body.
- Deploy idempotent webhook consumer with duplicate protection.
3. Core flow validation
- Create, read, and observe payment intent lifecycle.
- Confirm balance and ledger visibility in dashboards.
- Validate payout creation flow and status updates.
- Test cancel path for cancellable payouts.
4. Observability and operations
- Log API request IDs and your idempotency keys.
- Alert on webhook failure rate and payout failure statuses.
- Create runbooks for retries and partial incident handling.
Cutover strategy
Run a short canary window in live with low-risk transactions first, then ramp traffic after webhook and reconciliation stability is confirmed.