Skip to main content

Go-Live Checklist

Before moving from sandbox to production, work through this checklist to make sure your integration is ready for real transactions and live users.

Credentials & Environment​

  • Production API keys have been issued and securely stored (never committed to source control or exposed in frontend code).
  • All API calls point to the production base URL, not the sandbox URL.
  • Environment-specific configuration (sandbox vs. production keys/URLs) is managed via environment variables, not hardcoded.
  • Secret keys are only used server-side — never exposed in client-side/browser code.

Idempotency & Reliability​

  • Every state-changing request (create, update, activate, payout, etc.) includes a unique x-request-id / idempotency key.
  • x-request-id is unique per request, for proper request tracking.

Webhooks​

  • Webhook endpoint is subscribed for the events relevant to your integration. (cardholder status, KYC/RFI updates, card status changes, transactions, payouts, etc.).
  • Webhook endpoint is publicly reachable, uses HTTPS, and returns a 200 response promptly on receipt.

KYC & KYB​

  • Your flow correctly handles all KYC outcomes — Approved, and RFI (Request for Information).
  • RFI handling is implemented: retrieving RFI details and submitting responses, with re-evaluation handled correctly.
  • Business KYB status is confirmed with the HashDT team before go-live, since business onboarding is a manual process.

Card Programs (if applicable)​

  • Your integration correctly handles every card status relevant to your program ( Core / PowerUp ).
  • Status-change edge cases are handled — e.g. attempting an invalid transition returns a clear error your system can act on.
  • Card activation flow is tested end-to-end for both virtual and physical cards, where applicable.

Banking (if applicable)​

  • Account creation flow correctly handles the PENDING state and polls/updates via Get Account Details.
  • Beneficiary requests are built dynamically from the Beneficiary Schema API, not hardcoded per corridor.
  • FX and Payout quotes are executed before expiry — your system checks quote validity and re-generates if expired.
  • Payout requests include an idempotency key proper request tracking.

Security & Compliance​

  • Sensitive card data (PAN, CVV, expiry) is only ever displayed via the Secure Iframe — never logged, stored, or passed through your own backend.
  • All production traffic uses HTTPS.
  • Access to production API keys is limited to necessary personnel/systems only.

Final Testing​

  • Sandbox testing completed for the specific flows your integration uses.
  • Support contact (support@hashdt.com) is available to your team in case of go-live issues.

Ready to go live? Once you've confirmed the items relevant to your integration, reach out to your HashDT contact to finalize production access.