Go live with evidence

Complete the Sandbox quickstart, delivery/return recipes and webhook tests before requesting Production access.

• Create a Production credential with only the required scopes. Check organization policy, subscription and the project's Production readiness screen. Sandbox IDs and subscriptions do not transfer to Production.
• Store credentials and signing secrets server-side. Document rotation and revocation. Verify logs redact headers, raw bodies, contacts, capability URLs and proof.
• Configure a reachable HTTPS callback, raw-body signature verification, clock synchronization and durable event-ID deduplication.
• Persist operation IDs and exact payloads before the first network call. Bound timeouts/retries and distinguish 409 correction from transient retry.
• Test delivery proof before completion, pickup versus receipt proof, expired/replaced recipient links, duplicate events, wrong scope/environment and out-of-order events.
• Test customer return and failed-delivery RTS to completion. Confirm that neither path automatically executes refunds or stock changes.
• Test 503 retry, dead-letter inspection and manual replay against a synthetic subscription. Confirm one business action after duplicates.
• Assign an owner for webhook/notification alerts, stale returns and return approval backlog. Document your incident contact route and escalation hours; this guide does not invent a support SLA.
• Verify backups, durable journals, migration readiness and data-protection keys.
• Record the environment, test results, approver and rollout time for your release.