Best Practices

• Use decimal strings for money.
• Persist idempotency keys and event IDs with unique constraints.
• Keep clocks synchronized for webhook freshness checks.
• Treat customer payments and service-balance top-ups as different flows.
• Keep Test and Live keys, webhooks and order processing separate; verify the actual network.
• Do not log API keys, webhook secrets, refresh cookies, or raw authorization headers.

Before Live, complete project readiness and test every current Live webhook configuration. Exercise unavailable routes, uncertain creation with the same saved idempotency key, invalid signatures, wrong order/mode/event and duplicate fulfillment with local fixtures. Keep checkout capability URLs out of logs and analytics. Use the order confirmation recipe, and establish a process for payment exceptions before requesting another transfer.