> ## Documentation Index
> Fetch the complete documentation index at: https://developers.perkstar.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Go-live checklist

> Verify security, correctness, and operational recovery before sending production traffic.

Use this checklist for every integration, even when the first test looked
simple. Loyalty errors are customer-visible and often occur during a busy sale.

## Credentials

* [ ] A new live key exists for this integration only.
* [ ] The key has the minimum scopes required.
* [ ] The secret is stored server-side and is absent from source control and logs.
* [ ] The owner and rotation process are documented.
* [ ] The test key is not used in production.

## Customer and card mapping

* [ ] Upstream customer references are stable and namespaced.
* [ ] Every store or programme maps to an explicit Perkstar `card_id` when several cards exist.
* [ ] Perkstar `locationId` mappings have been checked for every venue.
* [ ] Current opaque and legacy wallet barcode values are passed through unchanged.
* [ ] Consent flags are copied only from an auditable consent source.

## Transactions

* [ ] Every POST has a stable `Idempotency-Key`.
* [ ] POS awards include a permanent `external_transaction_id`.
* [ ] A simulated timeout followed by a retry creates one result.
* [ ] A duplicate upstream webhook creates one result.
* [ ] Full refunds reverse the original transaction.
* [ ] Partial-refund behaviour has been agreed with the business.
* [ ] The card type rejects incompatible transaction types cleanly.

## Failure handling

* [ ] `429` respects `Retry-After`.
* [ ] Network errors and retryable `5xx` responses enter a durable retry queue.
* [ ] Non-retryable `4xx` failures are visible to an operator.
* [ ] Offline operations retain their original stable IDs.
* [ ] Reconciliation can detect an order with no matching Perkstar transaction.
* [ ] Logs retain `X-Request-Id` but never API keys or full personal payloads.

## Webhooks

* [ ] Signatures are verified against the raw body.
* [ ] Event IDs are deduplicated in persistent storage.
* [ ] Test events are separated using `testMode`.
* [ ] Events can arrive more than once or out of order.
* [ ] The receiver acknowledges only after durable storage or processing.

## Launch

1. Process one low-risk live transaction.
2. Confirm the Perkstar ledger and wallet update.
3. Reverse it and confirm both systems.
4. Enable one location or small traffic group.
5. Monitor errors, retries, and reconciliation before widening traffic.


## Related topics

- [Quickstart](/quickstart.md)
- [Changelog](/changelog.md)
- [Connect Odoo](/guides/odoo.md)
- [Authentication and scopes](/fundamentals/authentication.md)
- [Test mode](/fundamentals/test-mode.md)