Skip to main content

QA checklist

Use this checklist before requesting production access.

Authentication​

  • API keys are stored in a secret manager.
  • Sandbox and production keys are separated.
  • Keys use least-privilege scopes.
  • Key rotation process is documented.

Payments​

  • Payment creation uses idempotency keys.
  • Quote expiry is handled.
  • requires_action is handled.
  • Failed payments are handled.
  • Returned payments are handled.
  • Payment references match internal systems.

Webhooks​

  • Endpoint uses HTTPS.
  • Signatures are verified.
  • Duplicate events are ignored safely.
  • Events are processed asynchronously.
  • Out-of-order events are handled.
  • Delivery failures are monitored.

Reconciliation​

  • Payment IDs are stored.
  • Quote IDs are stored.
  • Ledger entries are imported.
  • Statements are downloaded and matched.
  • Fees and FX are reconciled separately.

Security​

  • No keys in frontend code.
  • No secrets in logs.
  • User roles are configured.
  • Admin MFA is enabled where available.
  • Incident contacts are defined.

Compliance​

  • KYB data collection is complete.
  • Beneficiary data is accurate.
  • Purpose of payment is captured.
  • Customer terms and disclosures are shown where required.
  • Internal escalation path is defined for reviews.