Integration Checklist

Before switching to the production environment, confirm that all of the following items have been completed.

Basic Configuration

• [ ] Confirm integration role (Merchant / Seller)
• [ ] Confirm production Base URL
• [ ] Confirm API version

Credential Management

• [ ] Securely store Access Token or Merchant ID
• [ ] Securely store RSA private key (Merchant) or callback Secret Key (Seller)
• [ ] Token refresh logic implemented (Seller)

Security Implementation

• [ ] Signature string construction is correct (Merchant: SHA256withRSA)
• [ ] Callback signature verification implemented (Seller: HMAC-SHA256)
• [ ] Timestamp expiration handling
• [ ] Nonce replay prevention (Merchant)
• [ ] Keys are not exposed in client-side code, logs, or version control

Error Handling

• [ ] All API error codes are handled
• [ ] Automatic token refresh on expiration
• [ ] Server error retry with exponential backoff
• [ ] Network timeout handling

Callback Handling (Seller)

• [ ] Callback URL provided to the platform
• [ ] Signature verification logic is correct
• [ ] Idempotency handling based on X-Request-Id
• [ ] Duplicate requests return 200 without re-executing business logic
• [ ] Signature verification failures return 401/403

Integration Testing

• [ ] Production environment integration testing completed
• [ ] Verified all required request headers are present
• [ ] Verified signature algorithm produces correct results
• [ ] Verified callback reception and response
• [ ] Saved necessary request/response logs for debugging

Monitoring & Operations

• [ ] API call failure alerts configured
• [ ] Callback reception anomaly alerts configured
• [ ] Token refresh failure alerts configured
• [ ] Logging enabled (excluding sensitive data)

After Completing All Items

Notify the iGV platform that you are ready to switch to production. The platform will confirm before going live.