Go-live checklist

Work through the list with your account manager. Every item links to the page that explains it.

Accounts and keys

• Production tenant created; you have its id, currency and locale.
• Production integration API key stored in your secret manager, used only by your servers (Security).
• Production wallet secret stored where your wallet endpoints run, and different from the sandbox one.
• Your walletUrl (HTTPS) registered with us, and our outbound IPs allowlisted on it (Security).

Sessions and embedding

• Sessions are created server to server; the page only receives launch tokens, right before mounting (Player sessions).
• No session token in any URL; no ?token= launches left.
• onSessionExpired returns a fresh launch token; logging out of your site calls logout().
• embedOrigins lists exactly your production origins, and no staging or local ones (Embedding).
• Your page’s CSP allows the sportsbook origin in script-src and frame-src.
• fill sizing on phones, the bet slip usable on a small screen, deep links and route sync working (Embedding).
• login_required opens your login and deposit_requested your cashier.
• For Brazil: the player’s CPF is sent with every session.

Wallet

• Signature verified over the raw body, in constant time, with the ±300 s window; servers on NTP (Wallet API).
• txId idempotency in the same transaction as the movement, including stored refusals (Idempotency).
• insufficient_funds for short stakes; no 4xx for temporary failures.
• Zero-amount credits accepted and used to close lost bets.
• Correction debits applied even when the balance goes negative.
• Rollbacks: refund once; remember unknown debits and refuse them later.
• Endpoints answer well within 5 seconds at peak load.
• Monitoring and alerts on wallet errors and latency.

Operations

• Every test case of Testing passed in the sandbox, with logs kept.
• Daily reconciliation against the back office reports in place (Reconciliation).
• Theme published and checked on desktop and mobile (Theming).
• Back office users created for your traders and support staff.
• A contact for incidents on both sides, and a plan for wallet outages (stakes are refused; credits are retried until you are back).
• Legal sign-off for every jurisdiction you open, and the jurisdiction kill switch state confirmed with us.