Going live checklist

Before relying on an integration in a running store:

Keys

• One key per system, named after it.
• Only the scopes it needs. Leave out read_customers and read_costs unless they are needed.
• The key is in your server's settings or a secrets manager, never in code, a website or an app.
• You know how to roll it, and who to tell when you do.

Requests

• Errors are handled by code, and unknown codes by HTTP status.
• 429 waits for Retry-After; 5xx retries later with growing waits.
• POSTs that change something send an Idempotency-Key, reused only for retries.
• Unknown fields and new values in lists of choices are ignored, not treated as errors.
• Amounts are treated as paisa.
• X-Request-Id is logged with failures.

Webhooks

• Every request's signature is verified, using the raw body.
• Old timestamps (over 5 minutes) are refused.
• Your endpoint answers 2xx within 10 seconds and does slow work later.
• Repeats are ignored by webhook-id.
• A periodic sync with updated_at_min catches anything missed.
• Someone watches the email for a switched-off endpoint.

Data

• Shoppers' details are stored safely and only as long as needed.
• The store's owner knows what the integration reads; it shows on Settings → Data exports.