Developer Go-Live Checklist

Go live only after the complete request and notification path is verified with controlled traffic. A successful catalog call alone does not prove that authentication, funding, ordering, querying, webhooks, and recovery are ready.

Assign owners and scope

Document the application owner, on-call contact, allowed products, expected volume, data classification, support path, and change window.

For Developer Go-Live Checklist, treat “Assign owners and scope” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Protect the active API key

Confirm the key is stored in a secret system, never appears in code or logs, and has the narrow mandatory IPv4 or CIDR whitelist.

For Developer Go-Live Checklist, treat “Protect the active API key” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Require HTTPS everywhere

Use HTTPS for Partner API calls and a valid public HTTPS webhook URL. Verify certificate, hostname, redirects, and network access from production.

For Developer Go-Live Checklist, treat “Require HTTPS everywhere” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Implement idempotent orders

Generate one stable partnerOrderNo per business attempt. On timeout, query the original order and never create a replacement reference automatically.

For Developer Go-Live Checklist, treat “Implement idempotent orders” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Enforce price and balance guards

For activation, set maxPrice based on an approved business limit. Treat catalog stock as an estimate and handle price, stock, and balance rejection safely.

For Developer Go-Live Checklist, treat “Enforce price and balance guards” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Handle errors and bounded retries

Branch on stable code, preserve traceId, correct non-retryable requests, and use limited retry with backoff only for documented transient failures.

For Developer Go-Live Checklist, treat “Handle errors and bounded retries” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Verify webhook security

Validate signatures, store event identity before side effects, return exact SUCCESS after safe acceptance, and handle the maximum five attempts.

For Developer Go-Live Checklist, treat “Verify webhook security” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Monitor and rehearse rollback

Alert on authentication failures, order errors, webhook retries, latency, and unexpected status rates. Know how to stop traffic, revoke the key, and preserve evidence.

For Developer Go-Live Checklist, treat “Monitor and rehearse rollback” as one checkpoint rather than a reason to change several settings at once. Record what you saw, make one justified change, and keep the related order or account reference.

Practical checklist

1. Verify assign owners and scope, record the result, and continue only when the next action is clear.
2. Verify protect the active api key, record the result, and continue only when the next action is clear.
3. Verify require https everywhere, record the result, and continue only when the next action is clear.
4. Verify implement idempotent orders, record the result, and continue only when the next action is clear.
5. Verify enforce price and balance guards, record the result, and continue only when the next action is clear.
6. Verify handle errors and bounded retries, record the result, and continue only when the next action is clear.
7. Verify verify webhook security, record the result, and continue only when the next action is clear.
8. Verify monitor and rehearse rollback, record the result, and continue only when the next action is clear.

Use the final platform status and account history as the source of truth. Do not share passwords, full verification codes, authentication secrets, access tokens, or API keys in screenshots or support messages. More guidance is available in the MangoOTP Help Center.