---
title: Go-live checklist
description: What to check before accepting real crypto payments with Coinetic: security, reliability, customer experience and the sandbox scenarios to test first.
url: https://coinetic.money/docs/go-live/
lang: en
---

# Go-live checklist

Work through it before accepting real money. Your checkmarks are saved only in your browser.

Done: 0 of 0

## Security

- The API key secret lives only on the server (a secrets manager or environment variable), not in git, an app or the browser.
- A **separate** key has been issued for production; sandbox keys aren't used in production.
- Webhook: `https://`, a public address, port 443; the signature is verified against the raw body; the time window is 5 minutes.
- Orders are fulfilled only on `paid` or `overpaid` from `GET /v1/invoices/{id}`, not on the webhook or `return_url`.
- Fulfillment is idempotent: a repeated webhook doesn't fulfill the order twice.
- Invoices and events with `livemode: false` are rejected.
- The server clock is synced (NTP).

## Reliability

- Every `POST /v1/invoices` carries an `Idempotency-Key` derived from the order number; retries after network errors reuse the same key.
- The webhook handler responds within 10 seconds; heavy work goes to a queue.
- There's a fallback reconciliation: orders pending longer than N minutes are re-checked via `GET /v1/invoices/{id}`.
- `underpaid`, `expired`, `late_payment`, `manual_review` and `invoice.reorged` are handled.

## Customer experience

- The order page clearly shows: awaiting payment, paid, underpaid, expired.
- There's a “Continue to payment” link to `checkout_url` while the invoice is valid.
- The mobile app opens checkout in the system browser, and `return_url` is a universal link.
- App Store and Google Play rules for digital goods have been taken into account.

## Tested in the sandbox

- Exact payment, underpayment plus top-up, overpayment, two halves.
- Expired invoice: a new invoice for the same order.
- Forged and stale webhooks are rejected; a retry doesn't fulfill twice.
- Webhook secret rotation and API key rotation without downtime.

> **All checked?.** Issue a production key in the [dashboard](https://dash.coinetic.money/merchant), switch `baseUrl` to `https://pay.coinetic.money`, and start accepting your first real payments.