TeePayDocs
Getting started

Go-live checklist

Everything to verify before you take real customer payments.

Account and keys

  • Your business is verified and the products you need show true in /v1/capabilities.
  • Live keys have only the scopes you use and are stored in a secret manager.
  • You know how to rotate and revoke a key.

Payments

  • Every create request sends a stable Idempotency-Key derived from your order, not a random value per attempt.
  • You fulfil orders only on succeeded (or paid for checkout sessions), never on a redirect or a 202.
  • You handle failed, including status_detail cancelled and expired, and let the customer try again with a new order key.

Webhooks

  • A webhook URL is set on your payment profile and the signing secret is stored on your server.
  • You verify X-TeePay-Signature on the raw body and reject old timestamps.
  • You de-duplicate on X-TeePay-Event-ID and respond 2xx quickly.
  • You also read the status of orders whose webhook has not arrived.

Operations

  • You log TeePay's request_id from errors, never full API keys or customer PINs.
  • You honour Retry-After on 429 and 503.
  • You reconcile your orders against GET /v1/collections every day.

On this page