Go-live checklist

Security

• The API key secret lives only on the server (a secrets manager or environment variable), not in git, an app or the browser.
• A separate key has been issued for production; sandbox keys aren't used in production.
• Webhook: https://, a public address, port 443; the signature is verified against the raw body; the time window is 5 minutes.
• Orders are fulfilled only on paid or overpaid from GET /v1/invoices/{id}, not on the webhook or return_url.
• Fulfillment is idempotent: a repeated webhook doesn't fulfill the order twice.
• Invoices and events with livemode: false are rejected.
• The server clock is synced (NTP).

Reliability

• Every POST /v1/invoices carries an Idempotency-Key derived from the order number; retries after network errors reuse the same key.
• The webhook handler responds within 10 seconds; heavy work goes to a queue.
• There's a fallback reconciliation: orders pending longer than N minutes are re-checked via GET /v1/invoices/{id}.
• underpaid, expired, late_payment, manual_review and invoice.reorged are handled.

Customer experience

• The order page clearly shows: awaiting payment, paid, underpaid, expired.
• There's a “Continue to payment” link to checkout_url while the invoice is valid.
• The mobile app opens checkout in the system browser, and return_url is a universal link.
• App Store and Google Play rules for digital goods have been taken into account.

Tested in the sandbox

• Exact payment, underpayment plus top-up, overpayment, two halves.
• Expired invoice: a new invoice for the same order.
• Forged and stale webhooks are rejected; a retry doesn't fulfill twice.
• Webhook secret rotation and API key rotation without downtime.