Go-live checklist

Work through this checklist before your first real payment. Every item links to the guide that explains it in detail — if any item fails, fix it and re-test in test mode before switching anything to live.

Account and payment methods#

• Account verification (KYC) is complete and live payments are enabled (Create your FlowAlp Pay account).
• All payment methods you advertise are activated with live contracts (Activate payment methods).
• Payment methods and providers are switched from test mode back to Live (Testing for developers).

Credentials and configuration#

• The production API Secret is stored in a secret manager or environment variables — not in code or repositories (API credentials).
• Test and staging secrets are removed from the production configuration.
• No secret ever reaches browsers, mobile apps, or logs.
• API version v1.16 is used consistently across all calls (API versions and changelog).
• SignatureCheck succeeds from the production environment with the production credentials.

Checkout and redirect URLs#

• success, failed, and cancel redirect URLs point to your production domain and are reachable over HTTPS.
• Every order sends a unique referenceId, so payments can always be matched to orders (First API request).
• Embedded checkouts (iFrame or modal) are tested on your target browsers and devices, including payment methods that force a redirect out of the frame (Checkout embedding overview).

Webhooks#

• A public HTTPS webhook endpoint is configured (Configure webhooks).
• Signature verification is active and unsigned or invalid deliveries are rejected (Verify webhook signatures).
• The handler is idempotent: repeated deliveries of the same event never double-process an order.
• The endpoint acknowledges deliveries quickly — within 20 seconds — and defers heavy work to a queue.
• Order state changes only after a verified webhook or an API retrieve — never based on the redirect alone.

Error handling and resilience#

• Retries with capped exponential backoff and jitter cover 5xx responses and the 405-then-403 rate-limit pattern (Rate limits).
• Retry attempts are limited, and persistent failures raise an alert instead of looping.
• Outbound API calls have sensible timeouts.
• Logs record status codes and correlation references — never secrets or full card data (Errors).

Reconciliation and operations#

• Transactions are reconciled against your orders, and payouts against your bank account (List and retrieve Transactions, Payouts and reconciliation).
• The refund and cancellation process is defined and tested (Charge, capture, refund and cancel Transactions).
• An API key rotation plan exists, and keys can be swapped without downtime (API credentials).
• Your team knows where to find the request logs in the dashboard and whom to escalate to internally.