Go-live checklist

Work through this list before you point production traffic at JuicePay. Each item exists because we have seen it cause a real incident somewhere.

Keys and access#

• Production keys are stored in a secret manager, never in environment files committed to a repository.
• Each service has its own key with the narrowest scope that works.
• Sandbox keys are absent from production environments, and production keys from CI.
• At least two people in your organisation can rotate keys, and you have practised doing it.

Correctness#

• Every mutating request sends an Idempotency-Key derived from your own business identifier, not a random value.
• Webhook handlers verify the signature before reading the payload body.
• Webhook processing is idempotent — a duplicate delivery for the same event ID changes nothing.
• Terminal states are treated as terminal. A payout.succeeded event is never re-requested.
• Amount arithmetic uses decimal strings end to end. No floats.

Resilience#

• Retries use exponential backoff with jitter and a documented ceiling.
• A webhook endpoint that returns 5xx is retried; one that returns 4xx is not treated as transient.
• Your queue survives a JuicePay outage without losing events — deliveries are retained for 7 days and replayable.
• Alerts exist for a rising error rate, an empty webhook receive queue, and a payout stuck in processing beyond your SLA.

Reconciliation#

• Daily settlement reports are ingested into your ledger automatically.
• The sum of your internal records matches /v1/balances at a known point in time.
• Unmatched items have an owner and a documented escalation path.

Compliance#

• You have confirmed which jurisdictions you disburse into and collected the required counterparty data.
• Sanctions screening is enabled on payout recipients.
• Your disclosures accurately describe who holds the assets at each stage.
• Retention policies cover both your records and the events JuicePay retains on your behalf.

Before you flip the switch#

Run a live-disabled rehearsal first: deploy with the production base URL but route all writes to sandbox keys, so you exercise configuration, networking, and secrets without moving value. Then enable writes in a low-traffic window and watch the first ten payments end to end.