Go-Live Checklist

Credentials & Configuration

• Production endpoint_id, merchant_login, and merchant_control_key received from Centiwise
• All credentials stored in environment variables or a secrets manager — not in source code
• Sandbox credentials removed from the production environment
• .env file added to .gitignore

Authentication

• OAuth RSA-SHA256 signing implemented and tested against the live endpoint
• Control hash generation verified: correct field order, no separators, hex output
• Control hash tested for all currencies your integration uses
• No hard-coded Authorization headers or control values
• KEY PAIRS , The Private AND Public keys are created

Payin Integration

• Payin request tested for every target country with the correct purpose value
• Rwanda account_name field included on all RW Payin requests
• South Africa Payin sent without a purpose field
• redirect_url configured and tested — customer lands on the correct page after payment
• client_orderid is unique per transaction (use a UUID or prefixed sequence)

Payout Integration

• Payout request tested for every target country with the correct purpose value
• Rwanda account_name field included on all RW Payout requests
• South Africa Payout sent without a purpose field
• Cash menthod for EGP

Webhooks

• server_callback_url is publicly accessible over HTTPS
• Callback endpoint returns HTTP 200 within 10 seconds
• Callback processing is asynchronous (acknowledge first, process in background)
• Idempotency implemented — duplicate client_orderid callbacks handled gracefully
• Callback tested end-to-end: payment triggers callback, order status updates correctly

Error Handling

• DECLINED handled without auto-retry; customer is notified
• PROCESSING handled — system awaits the webhook for the final status
• INVALID_CONTROL_CODE surfaces an alert to your engineering team
• INVALID_REQUEST surfaces an alert with the problematic field identified
• REQUEST_CANCELED  For Terminated transactions
• TIMEOUTNetwork timeouts handled with a retry strategy using exponential backoff

Security

• All API calls use HTTPS
• Connect timeout set (≤ 30 s) and read timeout set (≤ 60 s)
• Sensitive fields (keys, signatures) excluded from logs
• Centiwise callback IPs allowlisted at the firewall level
• PCI DSS scope reviewed with your compliance team

Final Sign-Off

• End-to-end test run in production with a real low-value transaction
• Monitoring and alerting set up for failed callbacks and API errors
• Runbook or on-call procedure documented for payment failures
• Centiwise account manager notified that you are going live
• Share securely the PUBLIC KEY for Payout to be configured by Centiwise team on the Endpoints