Go-live Checklist

Before switching to production, confirm the following items from existing Transafe documentation.

Credentials

• [ ] Generate production RSA keys (PKCS#8, 2048-bit) per Production Credentials
• [ ] Keep the merchant private key secret; do not share it with the platform
• [ ] Submit the merchant public key in merchant console → Account Management → Application Configuration

Integration safeguards

• [ ] All POST requests use Content-Type: application/json
• [ ] Requests are signed with OPENSSL_ALGO_SHA256 per Signing & Verification
• [ ] Empty values ('', 0, 0.0, null, false, '0') are excluded from signing
• [ ] Trailing zeros after decimal points are removed before signing when required
• [ ] Request payloads do not contain Chinese characters
• [ ] User-facing errors are mapped from status enums; raw msg is not exposed

Webhooks & networking

• [ ] Collection/payout callbacks return HTTP 200
• [ ] Callback signature verification is implemented
• [ ] Server IPs are allowlisted in merchant console
• [ ] Platform callback IPs are allowlisted on your side
• [ ] Create-payout non-200 / timeout handling confirms order status before resubmit

Validation

• [ ] Sandbox callback testing completed via Testing Callback
• [ ] Country Collection/Payout flows verified in Countries & Regions