Required Before Live Traffic
1
Prove the first reviewed flow
Run at least one sandbox transfer or payment flow end to end with idempotency, API state inspection, and webhook handling.
2
Verify event consumers
Confirm signature verification, duplicate event handling, retry behavior, and alerting for failed webhook deliveries.
3
Confirm tenant controls
Check enabled products, limits, key environment, webhook endpoints, and internal access rules for the tenant.
4
Prepare operational review
Make sure support, finance, and compliance teams know where to inspect request state, delivery history, and audit evidence.
5
Switch keys deliberately
Move from sandbox keys to live keys only after the reviewed flow and operational checks pass.
Production Acceptance Criteria
- Live API keys are stored outside client-side code and source control.
- All money-affecting writes use deterministic request identity where documented.
- Webhook consumers verify signatures and deduplicate events.
- Draft/reference namespaces are not used in default production flows.
- Operational owners know how to investigate a failed provider callback, retry, or reconciliation mismatch.
- The integration team has a rollback or pause path for launch issues.