Go-Live Checklist | A55 Developer Docs

WhatProduction readiness checklist for A55 integration

WhyPrevent outages, data loss, and security vulnerabilities before going live

Reading Time15 min

DifficultyIntermediate

PrerequisitesWorking sandbox integration → All test scenarios passing

Your progress is saved

Check off items as you complete them — your progress is saved in your browser automatically. No login required.

0/23

OAuth2 token flow working — client_credentials grant returns a valid token against the production Cognito URL
Token refresh implemented — Your code refreshes the token before the 3600-second expiry, not after a 401
Credentials stored in environment variables — A55_CLIENT_ID and A55_CLIENT_SECRET are never hardcoded in source
No hardcoded secrets — Run git log -p | grep -i "client_secret" against your repo and confirm zero matches

All endpoints tested — Every API endpoint your integration calls has been tested in sandbox with valid and invalid inputs
Error handling in all code paths — Every API call has try/catch, handles HTTP 4xx/5xx, and logs the request_id
Retry logic with exponential backoff — Failed requests retry with delays of 1s → 2s → 4s → 8s (max 3 retries), and never retry 4xx errors
Idempotency keys on all POST requests — Every charge creation and refund includes a unique Idempotency-Key header (UUID v4)
Webhook URL configured — Your webhook_url is set in merchant configuration and reachable from the internet

All payment methods tested — Every payment method you accept (credit card, PIX, Boleto, etc.) has been tested end-to-end with test data
3DS flow verified — If you support 3DS, the redirect → challenge → return flow works correctly and you handle all outcomes
Refund flow tested — Full and partial refunds succeed, your system updates order status, and the customer is notified

HTTPS everywhere — All API calls use https://. No HTTP fallback. TLS 1.2+ enforced
Webhook HMAC verification — Every incoming webhook is verified using the shared secret before processing
Card data handling verified — Confirm that card data flows through A55's secure infrastructure and is never stored on your servers
LGPD consent — You collect user consent for data processing and have a privacy policy that covers payment data

Webhook delivery monitoring — You track webhook receipt rate and alert if delivery drops below expected volume
Error rate alerting — Your monitoring fires an alert if API error rate exceeds 5% over a 5-minute window
Settlement reconciliation automated — Daily settlement reports are downloaded and reconciled against your order database
Logging with request_id — Every API interaction logs the request_id from A55's response for support escalation

Production credentials obtained — You have received and configured production client_id, client_secret, and Cognito URL
DNS configured — Your webhook endpoint and any callback URLs are resolvable and point to production infrastructure
Production charge tested — You have made at least one real charge with a real card in production and verified the settlement