Integration checklist

Use this as an acceptance record with your integration contact. Complete the journeys with controlled data before allowing live business activity.

Reference edition 2026-10-19 • Selected public contract

productiontestingchecklistoperations

Account and credential checks

The correct vendor and environment are identified; required review is complete.
Required live-key delivery is explicitly supported for your integration. No secret is present in frontend bundles, source control or logs.
Missing scopes, revoked credentials and another vendor’s terminal all fail safely.
Owner/buyer/member identity boundaries are tested independently.

Registered hardware can complete ping and a real controlled read.
Active, expired, suspended, missing and revoked-card outcomes are rendered accurately.
A network timeout and a denied access decision appear as different states.
Clock skew is observable; device timestamps cannot override server decisions.
Buffered batches and duplicate requests have an agreed handling policy.

New and existing buyers complete the supported sign-in/checkout path.
Delayed callbacks, duplicate delivery, uncertain order creation, expiry and failed/cancelled payment are exercised.
A server-confirmed purchase maps to the expected membership.
The member can grant/revoke the supported fields; private profile data is minimized.
Report totals are reconciled with the provider and agreed billing arrangement.

Webhook raw bytes are verified; header/body event IDs and types agree.
Duplicate event IDs do not repeat side effects; unsupported events are handled safely.
Monitoring identifies credential failures, timeouts and delivery failures without leaking personal data.
The integration has a named recovery/support process and a credential-revocation plan.
Rollback and staged enablement are agreed. An HTTP 200 or source-file inspection alone does not close this checklist.