Go-live checklist
The checklist to run through before going to production, from account verification to webhook resilience.
10 min read
Before collecting real payments, go through this checklist. It avoids the most common surprises in production.
Account & keys
- Business verified (KYC completed in the Dashboard).
-
…_live_…keys injected via environment variables, never committed. - Secret key restricted to the server (environments).
- Key rotation tested and documented for your team.
Payments
- Systematic server-side verification before fulfillment (Accept a payment).
- Handling of
failed/canceledstatuses in the UI. - Idempotency keys on all creations.
- Currencies and amounts validated (major unit, no subunit).
Webhooks
- Production endpoint configured and signature verified (signature).
- Immediate
200response, asynchronous queue processing. - Idempotent receiver (deduplication on
event.id). - Behavior tested against retries.
Resilience & observability
- Back-off on
429and network errors (rate limits). - Orchestration rules and fallback validated in testing.
- Alerts configured (failure spike, settlements) in the Dashboard.
- Konsole access verified for production support.
Compliance
- Team roles with least privilege (Team & roles).
- 2FA enforced for the team.
- Tax configured if applicable (Tax).
Flip a single switch
In practice, going to production comes down to replacing test keys with
live keys and repointing webhooks. If your integration follows this checklist, the
switchover is a non-event.