Go-live checklist

Run through this list before you switch to production keys.

• GET /v1/me succeeds from your production servers (signing, clock and IP allowlist are right).
• Players are credited only on deposit.confirmed. deposit.detected is shown as pending only.
• Webhooks are verified (signature and 5-minute window) before the body is parsed, and deduplicated on event_id.
• Your webhook endpoint replies 2xx within 10 seconds and does the work asynchronously.
• Every payout has a unique request_id, and timeouts are retried with the same request_id and a fresh signature.
• Amounts are handled as strings or big integers, never floats. BSC USDT has 18 decimals.
• The API secret and the webhook secret exist only on your servers, never in apps or browsers.
• Servers are synced with NTP.
• Your vault has funds, and its per-transaction and daily payout limits are set.
• You have a job that backfills from GET /v1/deposits in case webhooks are missed.