Go-Live Checklist

Run this list before pointing real traffic at your integration. Every item links back to the page that explains it.

Credentials and access

• API keys live in a secret manager; nothing in source control, browsers, or mobile apps. (Authentication)
• Scopes are split by system: display keys can't order, ordering keys can't withdraw, wallet.withdraw exists only in treasury tooling.
• Production keys carry a CIDR allow-list pinned to your egress addresses.
• Key rotation is rehearsed: issue → deploy → revoke, with both valid during the overlap.
• 401/403 responses page someone — they mean revoked/expired/mis-scoped credentials.

Ordering correctness

• Every POST /orders and POST /orders/{id}/fulfillment carries an Idempotency-Key derived from your order identity and persisted with it. (Orders)
• Timeouts and 5xx on order creation retry with the same key — no check-then-resend logic.
• Your state machine handles all nine order statuses, treats unknown statuses as non-terminal, and only marks delivery on Fulfilled.
• ReconciliationRequired orders surface in your back office instead of silently aging.
• Quotes are created at checkout time and never cached past expiresAtUtc. (Quotes)

Secrets handling

• Fulfillment is revealed late, over the dedicated endpoint, and artifact values are scrubbed from logs, APM, and error reports. (Fulfillment)
• If codes must be stored, they are encrypted at rest with restricted access; otherwise they are delivered and dropped.
• revealCount is tracked and an unexpected increase alerts.

Webhooks

• Signature verification implements all four rules: raw-body HMAC, constant-time compare, ±5-minute freshness, parse-after-verify. (Webhooks)
• Deduplication by X-Xegora-Event-Id is durable (database unique index).
• The receiver acknowledges in <2 s and defers real work to a queue.
• Out-of-order retries are tolerated (state compared by timestamps, or re-read from the API).
• The xgwh_ secret is stored like a password and endpoint rotation is rehearsed.
• A reconciliation sweep of GET /orders (and, for treasury, GET /wallet/deposits) backstops webhook gaps.

Wallet and treasury

• The deposit address was fetched once, verified Active, and the token contract + chain id are pinned in your runbook. (Wallet & Deposits)
• Balance monitoring alerts before availableBalance reaches your burn rate.
• Deposits reconcile by transactionHash + logIndex; withdrawals by publicReference. (Withdrawals)
• Withdrawal requests use read-before-retry on timeout.

Resilience and hygiene

• Backoff-with-jitter retry policy for 5xx/IO; Retry-After honored on 429; nothing retries other 4xx. (Errors & Retries)
• Scheduled jobs are spread across the minute and sized within 120 requests/min/workspace.
• correlationId is logged on every non-2xx and included in support tickets.
• HTTPS keep-alive connection reuse is enabled; client timeouts are 10–15 s.
• Clocks are NTP-synced (webhook freshness depends on it).

When every box is checked, you are running the same patterns our own surfaces are built on. Welcome to production.