Go-live Checklist

Before processing real transactions, make sure your integration is robust, secure, and well-tested. Use this list for your production deployment.

Pre-production checklist

API configuration

• You configured your production credentials securely.
• Your application clearly separates staging and production environments.
• Your code uses the production base URL.
• You have a process to rotate keys if needed.

Security

• You use HTTPS for all API communications.
• Keys and secrets are stored securely (environment variables or a secrets manager), not in code.
• Your integration validates and sanitizes all user input before sending it to the API.
• Your error handling doesn't expose sensitive data in logs or to the end user.

Integration testing

• You tested payments with cards, SPEI, and OXXO Pay.
• You tested withdrawals with SPEI and debit cards.
• You tested common error scenarios: declines, validation errors (422), and authentication failures (401).
• You tested the 3D Secure flow for cards.
• You set up and tested a webhook endpoint.

Final deployment checklist

• A security audit was completed.
• Performance and load testing were conducted at expected volumes.
• Monitoring and alerting systems are active for success rates and errors.
• Your team is trained on operational procedures for payment incidents.
• You have a clear rollback plan for critical post-deployment issues.
• You verified compliance with applicable regulatory requirements (e.g. PCI DSS).

Post-deployment monitoring

Next steps