# Go live checklist (/docs/guides/go-live)

- [ ] Your business is **verified** in the dashboard. Live keys only work after verification.
- [ ] You created **live** keys with only the permissions you need, and stored the secret in your server's secret store.
- [ ] Your **live webhook URL** is set, uses HTTPS, and [verifies signatures](/docs/guides/webhooks#verify-the-signature).
- [ ] Orders are fulfilled only after a webhook or a `PAID` session, never just because the customer reached your return page.
- [ ] Fulfilment is **idempotent**: the same event twice doesn't ship twice.
- [ ] Every write sends an `x-idempotency-key`, and retries reuse it.
- [ ] You handle `requiresReconciliation: true` by waiting, not retrying.
- [ ] Your server IPs are on the **IP allow-list** (recommended).
- [ ] You tested failures in test mode: failed payment, expired session, failed payout.
- [ ] Amounts are sent in kobo as strings.