Skip to main content

Going Live Checklist

Work through every section before switching to production credentials. These are the exact things that cause failures in first production deployments.

1. Account & Credentials​

  • KYB submitted and approved on the Onmeta Merchant Dashboard
  • Production Client ID and Client Secret obtained from Dashboard → Setup → API's Setup
  • Integration tested end-to-end on staging before switching to production

2. IP Whitelisting​

  • All production server outbound IP addresses identified
  • IP addresses sent to your Onmeta integration contact or support@onmeta.in
  • Onmeta confirmed whitelisting is active
warning

API calls from non-whitelisted IPs are rejected in production. Confirm this before go-live.

3. Webhook Configuration​

  • Webhook URL configured in Dashboard → Setup → Callback URLs
  • HMAC-SHA256 signature verification implemented — see Webhook Security
  • Endpoint responds with HTTP 200 within 10 seconds (Onmeta does not retry on timeout)
  • All on-ramp webhook events handled: fiatPending, fiatReceived, orderReceived, transferred, completed, expired, refunding, refunded

4. KYC Flow​

  • KYC status check integrated (POST /v1/users/kyc-status)
  • KYC upload flow integrated or KYC Widget used for API integration cliets.

5. On-Ramp Specific​

  • Bank or UPI linking flow implemented (POST /v1/users/account-link or POST /v1/users/upi-link)
  • Payment details (bank account or UPI QR code) displayed to user after order creation
  • UTR submission implemented — user must submit UTR after payment (POST /v1/orders/utr)
  • 3-hour order expiry communicated in UI; user shown how to create a new order if expired
  • fiatRefundInitiated status handled — payment from unlinked account triggers a fiat refund within 24 hours

6. Off-Ramp Specific​

  • Bank account linked before order creation
  • User shown the receiverWalletAddress from the order response — this is where they send crypto
  • Transaction hash submission implemented after user sends crypto (POST /v1/offramp/orders/txnhash)
  • Settlement timeframe communicated to user (standard: 24 banking hours after crypto receipt)
  • Merchant wallet flow: dedicated wallet address received from Onmeta tech team before using the Load Merchant Wallet API

7. Error Handling​

  • All documented error codes handled — see Troubleshooting
  • 401 Unauthorized handled: re-authenticate the user (token expires every 15 min)
  • 429 Daily limit exceeded handled: show remaining daily limit using the Fetch User Limit API
  • 403 blocked profile handled: show message, do not retry
  • 430 Wallet already used handled: show error, do not retry with the same wallet address

8. Order Status Polling​

  • Status polling implemented at 10–15 second intervals (POST /v1/orders/status)
  • All terminal statuses handled — completed, expired, cancelled, refunded; stop polling on terminal
  • All intermediate statuses display appropriate progress UI — see Order Status Guide

9. Final Testing​

  • Full on-ramp order placed end-to-end on production (small amount)
  • Webhook received, HMAC signature verified, and order state updated correctly
  • Off-ramp order placed end-to-end on production (if applicable)
  • Error scenarios tested: expired access token, missing UTR, wrong wallet address

10. Go-Live​

  • Onmeta integration contact notified before launching
  • Monitor first 24 hours of production orders
  • Webhook failure alerting set up