Developer guide
Go-live checklist
What must be true before you point production traffic at us.
1 / 3
Before the switch
Secret keys are server-side only
Not in a mobile binary, not in a front-end bundle, not in a repository.
Idempotency-Key on every money call
Derived from your order id — stable across retries.
Webhook signature verified
Over the RAW body, with the 5-minute window enforced.
Webhook handler is idempotent
The same delivery id can arrive twice.
Handler answers in under 10 seconds
Persist, return 2xx, process asynchronously.
You poll pending charges
A lost webhook must not become a lost payment.
You handle missing_required_fields
Ask the buyer for the field and retry with the same key.
You show amountLocal to the buyer
Never the USD figure.
You handle 429 with Retry-After
Back off on the header.
The switch
Swap the base URL and the key together. The environment follows the credential, so a sk_test_ against production is refused rather than silently creating test data — but the reverse is also true, and pointing at production with sandbox keys will simply not work.
Ask us for the static egress IP of your tenant before you go live if you allowlist inbound traffic to your webhook endpoint. Pin the IP family per subscription (
ipVersion) so the source address is stable.First 48 hours
Watch three things: your webhook delivery success rate, the share of charges that stay pending past their due date, and any 429. The first two tell you whether the integration is healthy; the third tells you whether your tier matches your real volume — tell us and we raise it.