Go-live checklist
Production readiness steps for your Chargeflow integration, covering keys, PII, webhook verification, idempotency, errors, and rate limits.
Run through this checklist before you point your integration at production traffic. Each item links to the page where the topic is documented in full.
Checklist
Store your API keys securely
Keep your API Access Key and API Secret Key out of source control and client-side code. Load them from environment variables or a secrets manager, and rotate them if they are ever exposed. The secret key is shown only once when generated. See Authentication.
Switch from test to live keys
Generate your production keys in the Chargeflow app under Settings → Developers and make sure your production deployment uses those keys, not any keys used during development. Confirm you are calling the production base URL https://api.chargeflow.io. See Authentication.
Handle PII responsibly
Dispute and customer data can include personally identifiable information. Limit who and what systems can read it, avoid logging full payloads, and retain only what you need. Send the exact request body you signed when using HMAC, so you do not reshape sensitive data in transit. See Authentication.
Verify webhook signatures
In production, verify the HMAC signature on every incoming webhook before acting on it. Recompute the signature from the request method, path, and body using your secret key and compare it to the X-Chargeflow-Hmac-Sha256 header. Reject requests that do not match. See Webhooks.
Use idempotency for retries
When retrying requests that create or generate resources, send an idempotency key so a retry does not produce a duplicate. The Idempotency-Key header can be used on evidence generation requests. See Idempotency.
Handle errors
Map the HTTP status codes the API returns to clear handling in your code, and log the requestId from each response so you can reference it with support. See Error Handling and the Error Codes Reference.
Respect rate limits
If you receive a 429 Too Many Requests response, back off and retry. Honor the Retry-After header to know how long to wait. See Rate Limits.
Pin your API version
Include an explicit API version in every request path, for example 2025-04-01, so future changes to newer versions do not affect your integration. See API Versioning.