Go-live checklist

Checklist#

1. 1

   Webhooks verified

   Your handler checks the signature (V2 with a timestamp window) and answers 2xx quickly.

2. 2

   Idempotent handlers

   The same event twice doesn't ship an order twice. Key on X-PesaBridge-Delivery or charge_ref.

3. 3

   Idempotency keys

   Every charge and payout sends an idem key, reused on retries.

4. 4

   Secrets on the server

   No sk_… key in an app, a web page or a repository. Rotation is documented for your team.

5. 5

   Second factor for money out

   Initiator configured if you make payouts or reversals.

6. 6

   Live webhook endpoint

   A live mode endpoint pointing at production, with its own signing secret.

7. 7

   Reconciliation

   A daily job compares GET /partner/transactions with your books.

Then request live access from the go-live page in the console. Once approved, swap to live keys; nothing else changes.