Quick-Start Checklist

Complete every step below before making your first live API call.

Step 1 — Get Your Credentials

Contact your Centiwise account manager to receive:

endpoint_id
merchant_login
merchant_control_key

⚠️
Never expose credentials in client-side code, logs, or version control.

Step 2 — Store Credentials Securely

Add your credentials to environment variables:

# .env  (add this file to .gitignore)
CENTIWISE_ENDPOINT_ID=your_endpoint_id
CENTIWISE_LOGIN=your_merchant_login
CENTIWISE_CONTROL_KEY=your_control_key

Step 3 — Implement OAuth Signing

Every request must include an Authorization header signed with RSA-SHA256.

→ See Authentication for the full implementation guide and code examples.

Step 4 — Implement the Control Hash

Every Payin request requires a control field — a SHA-256 hash that proves request integrity.

→ See Authentication → Control Hash for the formula and examples.

Step 5 — Set Up Your Callback Endpoint

Stand up a publicly accessible HTTPS endpoint to receive webhook callbacks from Centiwise.

Requirements:

Must return HTTP 200 within 10 seconds
Must handle duplicate deliveries idempotently
Must be served over HTTPS (TLS 1.2+)

→ See Webhooks for the full callback specification.

Step 6 — Test in Sandbox

Run end-to-end tests against the sandbox environment before going live. Verify:

Payin request signs correctly and returns success
Payout request signs correctly and returns success
Your callback endpoint receives and acknowledges the webhook
DECLINED and PROCESSING responses are handled gracefully

Step 7 — Go Live

Switch to your production endpoint_id and remove any sandbox overrides.

→ Review the full Go-Live Checklist before flipping the switch.