Reference
Go-Live Checklist
Work through this before sending real customer traffic through a live API key. Every item here maps to a specific incident this platform has actually had — this isn't generic advice.
Credentials
- Generate a live API key from the dashboard (API Keys → Live) with only the scopes your integration actually uses.
- Store the key in your backend's secret manager or environment variables — never in a repo, a mobile app bundle, or any frontend/client-side code.
- Set a webhook secret (dashboard → Webhooks, or PATCH /v1/merchant/webhook-config with regenerate_secret) and store it the same way.
Integration
- Every write request sends a fresh Idempotency-Key per genuine user action (not per HTTP retry of the same action).
- Your order-paid logic only triggers on collection.successful (webhook) or status: "successful" from GET /v1/collections/{id} — never on created, processing, pending_clearance, a QR/token being returned, or a push's initial resultcode.
- Your webhook endpoint verifies X-Infinity-Signature on every delivery before trusting the payload.
- Your webhook handler responds quickly (do slow processing asynchronously) and treats deliveries as idempotent — keyed off collection_id.
- You've tested Send Test Webhook from the dashboard against your real endpoint.
- You handle collection.failed, collection.reversed, and collection.pending_review distinctly from collection.successful in your own order state — a reversal after credit is a real scenario, not an edge case to ignore.
Payment methods
- Confirm which collection methods your account is provisioned for before you build against one.
- Test with a small real amount on a phone/account you control before sending real customer traffic.
Compliance & security
- Account KYC/onboarding is approved (see Onboarding Requirements).
- HTTPS only — for your webhook endpoint and everywhere you call the InfinityPay API from.
- No InfinityPay or payment-provider credential appears in any frontend bundle, mobile app package, or public repository.
Security best practices
Never ship a secret key to anywhere a customer's device can read it
An API key or webhook secret in a browser bundle, a mobile app package, or a public repository can be extracted by anyone. Keep both server-side; have client apps call your own backend, and have your backend call InfinityPay.
A few more that matter in practice:
- Rotate a key immediately if you suspect it leaked — Rotate on the API Keys page revokes the old one and issues a replacement with the same scopes in one action.
- Scope each key to only what it needs (collections:write for a checkout server doesn't need transactions:read).
- Verify every webhook signature — an unsigned or wrong-secret delivery should be rejected, not processed.
- Log request IDs / collection IDs, not full request/response bodies, if your logs might ever be shared for support — avoid retaining customer phone numbers longer than you need to.