Getting started
Go-live checklist
Everything to verify before you take real customer payments.
Account and keys
- Your business is verified and the products you need show
truein/v1/capabilities. - Live keys have only the scopes you use and are stored in a secret manager.
- You know how to rotate and revoke a key.
Payments
- Every create request sends a stable
Idempotency-Keyderived from your order, not a random value per attempt. - You fulfil orders only on
succeeded(orpaidfor checkout sessions), never on a redirect or a202. - You handle
failed, includingstatus_detailcancelledandexpired, and let the customer try again with a new order key.
Webhooks
- A webhook URL is set on your payment profile and the signing secret is stored on your server.
- You verify
X-TeePay-Signatureon the raw body and reject old timestamps. - You de-duplicate on
X-TeePay-Event-IDand respond2xxquickly. - You also read the status of orders whose webhook has not arrived.
Operations
- You log TeePay's
request_idfrom errors, never full API keys or customer PINs. - You honour
Retry-Afteron429and503. - You reconcile your orders against
GET /v1/collectionsevery day.