# Go-live checklist (https://docs.chargeflow.io/docs/reference/api-fundamentals/go-live-checklist)



Run through this checklist before you point your integration at production traffic. Each item links to the page where the topic is documented in full.

## Checklist [#checklist]

<Steps>
  <Step>
    ### Store your API keys securely [#store-your-api-keys-securely]

    Keep your API Access Key and API Secret Key out of source control and client-side code. Load them from environment variables or a secrets manager, and rotate them if they are ever exposed. The secret key is shown only once when generated. See [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication).
  </Step>

  <Step>
    ### Switch from test to live keys [#switch-from-test-to-live-keys]

    Generate your production keys in the Chargeflow app under **Settings → Developers** and make sure your production deployment uses those keys, not any keys used during development. Confirm you are calling the production base URL `https://api.chargeflow.io`. See [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication).
  </Step>

  <Step>
    ### Handle PII responsibly [#handle-pii-responsibly]

    Dispute and customer data can include personally identifiable information. Limit who and what systems can read it, avoid logging full payloads, and retain only what you need. Send the exact request body you signed when using HMAC, so you do not reshape sensitive data in transit. See [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication).
  </Step>

  <Step>
    ### Verify webhook signatures [#verify-webhook-signatures]

    In production, verify the HMAC signature on every incoming webhook before acting on it. Recompute the signature from the request method, path, and body using your secret key and compare it to the `X-Chargeflow-Hmac-Sha256` header. Reject requests that do not match. See [Webhooks](https://docs.chargeflow.io/docs/reference/concepts/webhooks).
  </Step>

  <Step>
    ### Use idempotency for retries [#use-idempotency-for-retries]

    When retrying requests that create or generate resources, send an idempotency key so a retry does not produce a duplicate. The `Idempotency-Key` header can be used on evidence generation requests. See [Idempotency](https://docs.chargeflow.io/docs/reference/api-fundamentals/idempotency).
  </Step>

  <Step>
    ### Handle errors [#handle-errors]

    Map the HTTP status codes the API returns to clear handling in your code, and log the `requestId` from each response so you can reference it with support. See [Error Handling](https://docs.chargeflow.io/docs/reference/api-fundamentals/error-handling) and the [Error Codes Reference](https://docs.chargeflow.io/docs/reference/error-codes).
  </Step>

  <Step>
    ### Respect rate limits [#respect-rate-limits]

    If you receive a `429 Too Many Requests` response, back off and retry. Honor the `Retry-After` header to know how long to wait. See [Rate Limits](https://docs.chargeflow.io/docs/reference/api-fundamentals/rate-limits).
  </Step>

  <Step>
    ### Pin your API version [#pin-your-api-version]

    Include an explicit API version in every request path, for example `2025-04-01`, so future changes to newer versions do not affect your integration. See [API Versioning](https://docs.chargeflow.io/docs/reference/concepts/api-versioning).
  </Step>
</Steps>

## Next steps [#next-steps]

* Review the [FAQ](https://docs.chargeflow.io/docs/reference/faq) for quick answers.
* Bookmark [Status](https://docs.chargeflow.io/docs/reference/status) to watch for incidents.
* Keep [Support](https://docs.chargeflow.io/docs/reference/support) handy for production issues.