Skip to main content

Go Live Checklist

Confirm each item before switching your integration to production. Most incidents come from skipping the verify step or leaking the API key — the rest of this list is cheap insurance.

Configuration​

  • Use the production API base URL (https://api.finomesh.com/api/v1) — see Environments.
  • Use the production checkout URL (https://checkout.finomesh.com).
  • Use a production gateway API key (a staging key is rejected in production).
  • Keep the API key server-side only — never in a browser bundle, mobile app, or client-side code.
  • Confirm your gateway is in verified status (an unverified gateway's key returns 401 auth_api_key_invalid).

Notifications​

  • Set callbackUrl for hosted checkout so the customer returns to your site.
  • Set webhookUrl if you want a server-to-server notification.
  • Verify the X-Webhook-Signature HMAC on every incoming webhook — see Webhooks.

Fulfilment logic​

  • Always call verify before fulfilling — do not fulfil from the callback alone or the webhook alone.
  • Handle all terminal statuses: SUCCESS, ACCEPTABLE, MISMATCH, EXPIRED — see Payment Statuses.
  • Treat monetary values as decimal strings and use a decimal library — never parse them as floats.

Testing before flipping the switch​

  • Test a successful payment end to end in sandbox.
  • Test an expired payment.
  • Test MISMATCH and ACCEPTABLE outcomes.
  • Test webhook retry handling (respond non-2xx once and confirm the retry arrives).

Cashout (only if you use it)​

  • The cashout/settlement API is off by default — confirm whether you actually need it.
  • If enabled, confirm the server IP allowlist, HMAC signing, and Idempotency-Key handling — see Cashout.