Skip to main content

Go-live checklist

What to verify before the account is approved, so the first live order behaves like the sandbox ones did.

Configuration​

  1. The secret lives on the signing server only: a secret store or an environment variable, never a browser, an app, a repository or a log.
  2. Every cash desk has a callback URL over https://, reachable from the internet, answering within 15 seconds, not behind a bot filter that rejects OneRamp/1.0 PesoCallback.
  3. The cash desk's rails and currencies match what you will send. With several rails allowed, every order passes rail.
  4. Amount limits on the cash desk are set deliberately, in USD, or left at zero.
  5. The server clock is synchronised with NTP.

Requests​

  1. GET /gw/v1/methods returns 200 from the production environment with the production secret.
  2. orderRef is sent on every order and stored together with our id.
  3. Amounts are decimals in your code, never floats; you parse the strings we return.
  4. You branch on fault.code, never on fault.detail, and log traceId for every fault.
  5. Retries are safe: 5xx, 429, FX_RATE_UNAVAILABLE and NO_AVAILABLE_METHOD retry with a back-off and the same orderRef; other 4xx do not retry.
  6. GET /gw/v1/methods is consulted before creating an order, or at least when creation starts failing, so a closed channel does not burn attempts.

Callbacks​

  1. The handler reads the raw body before any parsing.
  2. The handler verifies X-Gate-Sign with a constant-time comparison and answers 401 otherwise.
  3. The handler drops repeated X-Gate-Event-Id and answers 200 to a repeat.
  4. The handler answers 200 for every event it understands, including ones it chooses to ignore, and does slow work after answering.
  5. A simulated sandbox order produced order.completed and order.cancelled on your server, visible under What we sent you as 200.

Operations​

  1. Someone watches the cabinet's Appeals page and answers customers whose payment did not complete, with the receipt attached.
  2. Someone can rotate the secret and knows that rotation is immediate.
  3. Support has your contact email and phone from the Settings page.

Once approved, make one small live order, watch it complete on the Orders page including the callback attempt and your server's response, and check the credit on the Balance page.