Integration checks
- Keep API keys and webhook secrets on your backend.
- Verify that test and live keys use separate stored records.
- Persist an idempotency key before sending each money-moving request.
- Complete issuance, top-up, card-control, and reveal scenarios in sandbox.
- Test lost responses, duplicate webhooks, pending operations, and failure handling.
- Verify webhook signatures using raw request bytes and deduplicate event IDs.
- Confirm that logs, analytics, and error reports exclude full card data and secrets.
- Complete the company and cardholder verification requirements.