Going live checklist

Work through this list before you request live keys.

Integration

Every POST sends an Idempotency-Key and retries reuse the same key.
Webhook signatures are verified and events older than five minutes are rejected.
Webhook handling is idempotent: duplicate deliveries do not double-credit.
Your handler responds with 2xx within 10 seconds and processes asynchronously if needed.
credit.returned, credit.in_review and recall.opened are handled, not just credit.settled.
Daily statement reconciliation is in place.
Live and sandbox keys are stored separately and never in client-side code.

KYB on your business is complete and your agreement is signed.
Your holder verification process matches the standard agreed for your programme.
Shield rules are reviewed and first_party_only is on unless an exception has been approved.
Your team knows how to respond to review and recall cases within the stated timelines.
Your customer-facing material describes bank-transfer payments accurately and does not promise settlement times.

Console users have two-factor authentication enabled and appropriate roles.
Payout approval thresholds are configured.
Alerting is in place for webhook delivery failures.
Support contacts are registered so we can reach you about incidents and recalls.

When the list is complete, request live keys from the console. We review the request and monitor your first credits with you.