Skip to content

Go-live checklist

Use this checklist before switching traffic to production. It is designed for engineering, security, and finance teams collaborating on a commercial payments launch.

Credentials and environment

  • Production keys provisioned and stored in a secrets manager.
  • All callbacks and return URLs switched from sandbox to production domains.
  • Environment key prefixes validated (pk_live_/sk_live_ for production).

Security and compliance

  • Confirm PCI DSS scope and shared responsibility model with your security team.
  • Do not log full PAN or sensitive authentication data.
  • Webhook signature verification enabled in all environments.

Reliability and retry safety

  • Payment initiation sends a saved Idempotency-Key; do not assume other write endpoints support that contract.
  • Initiation retries retain their original key/payload; 202/unknown execution is investigated without a new payment. Respect Retry-After.
  • Monitoring and alerting configured for payment failure-rate and webhook failures.

Reconciliation and finance ops

  • Payment status query and settlement reconciliation jobs scheduled.
  • Finance exports validated with accounting stakeholders.
  • Refund and dispute response runbook documented and tested.

Sandbox parity and launch controls

  • End-to-end test matrix run in sandbox for success, failure, timeout, and webhook retry scenarios.
  • Feature flags or rollout controls prepared for phased production launch.
  • Rollback path documented in case of elevated failure rates after launch.