Skip to main content

​
Authentication and Security

  • API keys stored in a secure secret manager.
  • Webhook signature verification implemented and tested.
  • Constant-time signature comparison in place.
  • Replay-window and event-id dedupe implemented.

​
Transaction Flow

  • Quote mode and direct mode (fiat_amount + crypto_currency + network) validation implemented.
  • merchant_reference uniqueness enforced in your system.
  • Idempotency keys generated and persisted for writes.
  • Timeout recovery by merchant_reference implemented.

​
Webhooks

  • At-least-once + out-of-order handling implemented.
  • Durable event log for operational replay decisions.
  • Delivery telemetry endpoint integrated into on-call tooling.

​
Reconciliation

  • Scheduled transaction and revenue backfill jobs running.
  • Fixed-window reconciliation with cursor checkpoints enabled.
  • Exception queue for unresolved mismatches established.

​
Operational Controls

  • 429 handling and adaptive retry policy implemented.
  • Alerting configured for sustained webhook failures.
  • Alerting configured for create/cancel conflict spikes.
  • Runbook documented for webhook recovery incidents.