Go-live checklist

App and account

• App published (review approved). Production keys and payments need it (APP_NOT_PUBLISHED, APP_UNAVAILABLE).
• Payments Enabled; you know your single / daily / monthly limits and fee.
• Payouts approved, if you use them.
• Developer wallet active, with enough balance to cover refunds and payouts.

Credentials

• Production API key (ok_live_…) created; secret in a secret manager, not in code or the repository.
• Production callback URL set; callback secret stored.
• Sandbox and production credentials separated by environment in your configuration.
• A rotation plan: new key → deploy → old key expires after 24 h (or revoke).

Integration

• Requests signed with seconds-resolution timestamps from an NTP-synced clock.
• A new nonce per request; the same Idempotency-Key for retries of one operation.
• out_order_no unique per order and stored with the HTP id.
• Amounts are strings with at most 2 decimals; no floating-point math.
• Orders marked paid only from a verified callback or an order query — never from the browser.
• Callback handler: verifies signature and timestamp, de-duplicates on event_id, checks environment, amount and out_order_no, answers 2xx within 10 s.
• Errors handled by error_code; trace_id logged.
• Amount and limit checks on your side match your approved limits, so users see a clear message instead of LIMIT_EXCEEDED.
• The payout trigger (if any) is protected against abuse and double execution.

Operations

• Daily reconciliation against the statement CSV.
• A job that re-queries orders stuck in awaiting payment past expires_at.
• Alerting on callback failures and on SIGNATURE_INVALID spikes.
• Support process for users: refund policy, how to find an order by out_order_no.