Go-live checklist

Checklist

1. Organization verified: Console → Verification shows Live payments are open.
2. Team roles assigned: only people who manage keys, webhooks and wallets are admins. Secrets in a secret manager.
3. Security → Email delivery: send a test email and confirm it arrives.
4. Production destinations for each network and asset you accept.
5. Production restricted key with minimum permissions.
6. Production webhook endpoint in the production environment, signing secret stored, verifier accepts rotation headers.
7. Server environment variables point at the live API base. BOSPay-Version pinned in code.
8. Idempotency-Key on every POST; retries reuse it. Fulfillment deduplicated on event id.
9. A catch-up job that reads GET /events after downtime.
10. Small live payment reconciled: invoice, merchant receipt, 0.99% fee.
11. Tests: refresh, phone lock, duplicate events, partial, overpaid and late payments (manual_review), cancel, replay.
12. Alerts for delivery failures and settlement delays. Named operational contact.

Open your console →