Go-Live Checklist

Before you can receive a csk_live_ key, Cresora requires you to pass certification. Work through this checklist in order.

Certification

See the Certification overview →

Technical checklist

• All API calls use Idempotency-Key headers
• Webhook signatures verified server-side (HMAC-SHA256)
• Webhook receiver handles retries idempotently
• Error handling covers 4xx and 5xx responses gracefully
• No raw card data passes through your server (SAQ A compliance)
• PCI scope documented and SAQ completed
• Test card flows verified: approval, soft decline, hard decline, refund
• ACH return handling implemented (if using ACH)

Operational checklist

• Merchant onboarded and approved in production
• Go-live gates cleared (see Merchant Onboarding)
• Support escalation path documented
• Monitoring and alerting wired to webhook payment.failed events

Switching to production

Once certification is complete and Cresora grants your csk_live_ key:

1. Swap csk_test_xxxxxxxxxx for csk_live_xxxxxxxxxx in your secrets manager
2. Verify your webhook endpoint URL is publicly reachable
3. Process a small real transaction as a smoke test
4. Monitor your first 24 hours of live traffic closely