Go-live checklist

Work through this list before switching your shop to a sk_live_ key. Each line links to the detail.

Your Xaalis account

• Your account is active. Until then, live requests return 403 merchant_not_active — ask Xaalis to finish the review.
• You have a live secret key (sk_live_…), stored in your server’s secret store, never in browser code, a mobile app, a Git repository or a log.
• Your webhook secret is stored the same way.

Your integration

• Every POST /v1/payments and POST /v1/payouts (required there) sends an Idempotency-Key tied to your order or withdrawal — and, until B-4 is fixed, prefixed with the mode (live:order-1042). → Idempotency
• You fulfil orders only on the signed payment.succeeded webhook (or a server-side GET /v1/payments/{id}), never because the customer reached success_url. → Payments
• Your webhook endpoint is https://, verifies Xaalis-Signature over the raw body, rejects timestamps older than 5 minutes, answers 2xx within 10 s, and deduplicates on event id. → Webhooks
• It checks livemode: true before shipping — test and live events share one URL.
• You compare the webhook’s amount and client_reference with your order before fulfilling.
• Amounts are whole XOF everywhere in your code (no 1500.00, no floats).
• Errors are handled by code (insufficient_funds, idempotency_conflict…), not by message. → Errors
• success_url and cancel_url are https:// pages on your own site.

Test it in test mode first

• A payment that succeeds, one that fails and one that expires each reach the right order state.
• A duplicate webhook (replay the same event) doesn’t ship twice.
• A webhook with a wrong signature is rejected with 400.
• A payout that fails (recipient ending in 0000) is handled. → Test mode

On the day

• Swap sk_test_ for sk_live_ in your server configuration — nothing else changes.
• Make one small real payment yourself (e.g. 100 F CFA) with Wave and one with Orange Money, and watch the webhook arrive.
• Watch GET /v1/webhook-deliveries for failures during the first days.