# Going live checklist

Before relying on an integration in a running store:

## Keys

- [ ] One key per system, named after it.
- [ ] Only the scopes it needs. Leave out `read_customers` and `read_costs` unless they are needed.
- [ ] The key is in your server's settings or a secrets manager, never in code, a website or an app.
- [ ] You know how to roll it, and who to tell when you do.

## Requests

- [ ] Errors are handled by `code`, and unknown codes by HTTP status.
- [ ] `429` waits for `Retry-After`; `5xx` retries later with growing waits.
- [ ] POSTs that change something send an `Idempotency-Key`, reused only for retries.
- [ ] Unknown fields and new values in lists of choices are ignored, not treated as errors.
- [ ] Amounts are treated as paisa.
- [ ] `X-Request-Id` is logged with failures.

## Webhooks

- [ ] Every request's signature is verified, using the raw body.
- [ ] Old timestamps (over 5 minutes) are refused.
- [ ] Your endpoint answers `2xx` within 10 seconds and does slow work later.
- [ ] Repeats are ignored by `webhook-id`.
- [ ] A periodic sync with `updated_at_min` catches anything missed.
- [ ] Someone watches the email for a switched-off endpoint.

## Data

- [ ] Shoppers' details are stored safely and only as long as needed.
- [ ] The store's owner knows what the integration reads; it shows on **Settings → Data exports**.