Go-live checklist

Work through this list with your team before switching to production. Each item can be checked by a reviewer. When you are done, email to schedule the production switch.

Keys and environments#

• Production API key is stored in a secrets manager or environment variable, not in code.
• The secret API key is used only by servers; browsers and apps use the publishable key and a client_secret ( Authentication).
• The base URL comes from configuration and points to https://api.vnswitch.nivc.ai in production ( Environments).
• Sandbox and production keys, webhook URLs and hash keys are kept apart.

Payments and amounts#

• Amounts are integers in the minor unit; VND amounts are whole dong (150000 = 150,000 VND) ( Amounts and currencies).
• Orders are marked paid only after a server-side check: a webhook or a retrieve call, never the browser redirect alone ( Payment lifecycle).
• requires_customer_action is handled by following next_action ( Redirects and customer actions).
• Pending statuses (processing, refunds in pending) are handled without retrying the payment.
• With manual capture, uncaptured payments are captured or cancelled before the authorisation expires.

Webhook handling#

• The webhook endpoint is HTTPS and verifies X-Webhook-Signature-512 on every request ( Webhooks).
• Processing is idempotent: events are deduplicated by event_id.
• The endpoint answers with 2xx within a few seconds and does heavy work asynchronously.
• A reconciliation job retrieves payments whose final status never arrived.

Errors and operations#

• Client errors (4xx) are logged with the error code and not retried unchanged ( Errors).
• Timeouts and 5xx errors are retried only after checking the payment’s current status.
• Logs never contain API keys, client_secret values, full card numbers or CVCs.
• Alerts exist for rising error rates and for webhook signature failures.
• Card data handling has been reviewed against PCI DSS for your integration type.

Vietnam#

• Customer names and addresses are sent as UTF-8 and keep Vietnamese diacritics.
• Local methods you plan to offer (VietQR, NAPAS, bank accounts) are confirmed as enabled for your production account.