Skip to main content

Go-Live Checklist

Use this checklist before switching to production.

Authentication & Security​

  • Production API key generated and stored in a secure vault
  • No API keys in source code or config files in version control
  • Signature generation tested and matching B1Link verification

Webhooks​

  • Production webhook URL is HTTPS and reachable from B1Link
  • Webhook receiver returns 200 quickly and processes payload asynchronously if needed
  • Idempotency handled for duplicate or retried webhooks

API Integration​

  • Vendor number callback uses correct base URL and path: {baseUrl}/api/onboarding-request-erp-events/assign-erp-vendor-number-event
  • X-B1LINK-Signature header set with Base64(HMAC-SHA256(body, API key))
  • JSON body format: {"Id":"<guid>","ErpVendorNumber":"<string>"} (compact, no extra whitespace)

Operations​

  • Logging and monitoring in place (without logging API keys or full payloads)
  • Error handling and retries for 5xx and network failures
  • Runbook or support path for failed events

See Also​