Production Checklist

56 things to verify before accepting real payments. Progress saves to your browser.

Go-Live Progress0 / 56 (0%)

0%25%50%75%100%

Security 0/13

Switch to production API keysReplace staging keys with live keys from Dashboard

Secret key in environment variables onlyNever hardcode. Use .env, AWS Secrets Manager, or Vault

API key not in client-side codeAll API calls must originate from your backend

Checksum generated server-side onlyNever generate HMAC-SHA256 in browser JavaScript

Webhook signature verification implementedVerify X-SabPaisa-Signature with HMAC-SHA256 base64 + constant-time compare

Webhook replay protection (5 min window)Reject signatures with timestamps older than 5 minutes

HTTPS webhook URL configured (TLS 1.2+)HTTP endpoints are rejected in production

Webhook idempotency implementedUse idempotency_key field to prevent duplicate processing

IP whitelisting configuredDashboard → Settings → Security → IP Whitelist

Return URL verifies payment server-sideNever trust URL query parameters alone

No sensitive data in logsNo card numbers, CVVs, API keys, or secrets in logs

Production keys different from stagingAPI keys rotated from test values

CORS configured for checkout domainOnly allow your domain and SabPaisa checkout domains

Configuration 0/6

Production base URL: merchant-api.sabpaisa.inNot staging-sb-merchant-api.sabpaisa.in

Webhook URL registered in DashboardSettings → Webhooks → Add URL

Return URL set to production domainMust be your live domain, not localhost

Correct production merchant IDNot staging merchant ID

Amount sent in paise (not rupees)₹999 = 99900 paise. Double-check all calculations

Timestamp from server clock (not client)Unix seconds, within 5-minute window

Payment Testing 0/15

Successful UPI payment end-to-endCreate → redirect → pay → webhook → verify

Failed UPI payment handledFailure webhook received, error shown to user

UPI timeout/expiry handled30 min session expiry → EXPIRED status handled

Visa/Mastercard payment with OTPFull 3DS flow including OTP verification

RuPay card payment (redirect mode)RuPay uses REDIRECT, not OTP iframe

Card declined scenario handledFriendly message + alternative payment methods

Net banking payment testedFull redirect flow to bank and back

Wallet payment testedAt least one wallet provider

Full refund testedRefund 100% and verify webhook

Partial refund testedRefund partial amount, verify remaining

Multiple partial refunds tested2+ refunds, total doesn’t exceed original

Payment cancellation testedCancel → correct status → can retry

Duplicate prevention testedSame merchantTxnId rejected, idempotency works

Concurrent payments testedMultiple users paying simultaneously

Mobile checkout testediOS and Android browsers render correctly

Error Handling 0/9

400 errors show user-friendly messageMap API errors to human-readable messages

401/403 errors handled gracefullyRedirect to error page, log for investigation

429 rate limit with exponential backoffBackoff with jitter for rate-limited requests

500 errors retried with backoffMax 3 retries: 1s, 2s, 4s delays

Network timeout handled (30s)Show retry option to user on timeout

Webhook handler always returns 200Process async, never return 500. Return 200 even for duplicates.

Webhook responds within 10 secondsProcess heavy operations (DB, email) asynchronously after acknowledging

All 4 webhook events handledHandle payment.success, payment.failed, payment.expired, payment.timeout

Error responses log traceIdInclude traceId when contacting support

Monitoring & Alerts 0/5

Payment success rate monitoredAlert if rate drops below 90% in 15 min

Webhook delivery failures monitoredCheck Dashboard → Webhooks daily

API error rate trackedMonitor 4xx/5xx rates, alert on spikes

Transaction volume dashboardsDaily/hourly counts by payment method

Refund volume trackedAlert on unusual patterns (fraud detection)

Compliance & Documentation 0/8

PCI-DSS scope confirmedHosted Checkout / iFrame / Redirect = SAQ A. Custom UI (raw card collection) is not offered.

No card data stored on merchant serversPAN, CVV, expiry, full magnetic stripe/chip data must never reach your servers per RBI PA-PG §7.4 and §10.4. You may store only: last 4 digits of PAN + issuer name (for display).

Refund & cancellation policy publishedPublish on your site with per-instrument TATs (see Refund TAT table in API Reference).

Grievance / contact details publishedSurface grievance redressal and contact details on your checkout footer.

Authentication requirement understoodRBI mandates Additional Factor of Authentication (AFA) for all card-not-present transactions. ATM PIN is never the second factor for CNP (PA-PG §12.3). SabPaisa hosted checkout enforces this automatically.

Webhook secret stored in secrets managerAWS Secrets Manager / Vault / equivalent — never in source code or environment files committed to git.

Internal integration runbook writtenDocument payment flow, webhook handling, error recovery, on-call escalation.

Ready to go live?

Once all 56 items are checked, contact your SabPaisa account manager to activate live processing.

Contact Sales View API Reference

Quick Start

Get up and running in 30 minutes

Troubleshooting

Common issues and fixes

Changelog

Latest updates and releases

Was this page helpful?

Production Checklist

Security 0/13

Configuration 0/6

Payment Testing 0/15

Error Handling 0/9

Monitoring & Alerts 0/5

Compliance & Documentation 0/8

Ready to go live?

Related Pages

Production Checklist

Security 0/13

Configuration 0/6

Payment Testing 0/15

Error Handling 0/9

Monitoring & Alerts 0/5

Compliance & Documentation 0/8

Ready to go live?

Related Pages