HSRCPAY Documentation

Pre-Production Checklist

Technical, security, and operational checks before going live.

This list is a short gate check for SDK integration. Extended version for account, routing, and dashboard: Integration Readiness.

Release gate

Do not open traffic with production keys until all items are complete.

Integration

  • Create + confirm end to end (sandbox)
  • REQUIRES_ACTION and decline scenarios
  • If using checkout: return URL + webhook verification
  • Idempotency on write operations (endpoints supported by the SDK)

Webhook

  • HTTPS endpoint, signature verification
  • Idempotent handler by event id
  • Delayed/duplicate delivery test

Security

  • API key in secret manager
  • No PAN/CVV in logs
  • Dashboard roles with least privilege

Operations

  • 4xx/5xx and webhook error alerts
  • Support runbook with payment ID + trace
  • Rollback and communication plan

Compliance

  • Test evidence and release notes
  • Error code summary for support (Testing Declines)

Security and Compliance

Key management, data security, access control, and audit readiness.

Versioning and Changelog

SDK update policy, breaking change management, and team announcements.

On this page

IntegrationWebhookSecurityOperationsCompliance