Production checklist

Account and access

• Confirm active account status, product enablement and collection PSP mapping.
• Generate and store credentials server-side; approve stable outbound IPs.
• Confirm the deployed authentication handlers and required fields for your chosen workflows.

Request construction

• Verify signatures against exact serialized body bytes, resolved paths and query order.
• Keep server clocks synchronized and use a new HMAC nonce per request.
• Persist business references and payout idempotency keys before sending requests.

Transaction operations

• Verify payees for the selected payout method and confirm provider behavior.
• Configure inbound/outbound notify URLs and agree webhook verification/acknowledgement rules.
• Make notification processing safe to repeat and implement signed status recovery.
• Establish a support path for ambiguous payout/refund outcomes.

Launch deliberately

Coordinate any real-funds test with the authorized business team. No isolated sandbox, universal rate limit, published SLA or webhook replay facility is established in this documentation. Review known limitations before launch.