Skip to main content

​
Go Live

Before moving your Elite Neo Bank integration to production, merchants should complete all security validations, UAT testing, webhook verification, reconciliation checks, and operational readiness reviews. Going live means your application will begin processing real customer payments and payouts using production banking infrastructure. Proper production readiness helps ensure:
  • Stable transaction processing
  • Secure API communication
  • Reliable payment workflows
  • Accurate payout settlements
  • Safe customer experience

​
Production Readiness Requirements

Before production activation, merchants should ensure:
  • Sandbox integration completed successfully
  • UAT testing approved
  • Webhook verification implemented
  • Signature validation working correctly
  • Retry handling configured
  • Error handling implemented
  • Transaction reconciliation validated
  • Security review completed

​
Production Base URL

​
Production Credentials

Production credentials are issued after successful onboarding and compliance verification. Example production headers:

​
Environment Migration Checklist

Before switching from Sandbox to production:

​
Production Security Requirements

Merchants should implement:
  • HTTPS-only communication
  • Server-side signature generation
  • Secure credential storage
  • Webhook signature verification
  • Replay attack protection
  • Access control policies
  • Transaction audit logging

​
Webhook Production Setup

Before going live:
  • Configure production webhook URLs
  • Verify webhook signatures
  • Test duplicate event handling
  • Implement webhook retries
  • Store webhook audit logs
Webhook endpoints must:
  • Be publicly accessible
  • Support HTTPS
  • Return HTTP 200 quickly
  • Handle JSON payloads properly

​
Transaction Monitoring

Production systems should continuously monitor:
  • Payment success rates
  • Payout processing
  • Failed transactions
  • Webhook delivery status
  • API response failures
  • Retry attempts
  • Reconciliation mismatches

​
Payment Flow

  1. Create payment order
  2. Redirect customer to hosted checkout
  3. Receive webhook notification
  4. Verify payment using Order Status API
  5. Update internal order status
  6. Reconcile settlements

​
Payout Flow

  1. Check payout wallet balance
  2. Initiate payout
  3. Track payout status
  4. Store UTR/reference numbers
  5. Verify webhook notifications
  6. Reconcile payout records

​
Logging Recommendations

Merchants should securely log:
  • API requests
  • API responses
  • Transaction references
  • Webhook payloads
  • Retry attempts
  • Error responses
  • Signature verification results
These logs help with:
  • Debugging
  • Audit tracking
  • Reconciliation
  • Compliance reviews

​
Common Production Issues

​
Invalid Signature

Possible reasons:
  • Incorrect secret key
  • Payload modification
  • Timestamp mismatch

​
Webhook Failures

Possible reasons:
  • Incorrect webhook URL
  • SSL certificate issues
  • Slow webhook responses

​
Authentication Errors

Possible reasons:
  • Invalid production API keys
  • Expired timestamps
  • Incorrect signature generation
Before enabling live traffic:
  • Complete end-to-end testing
  • Verify webhook security
  • Validate reconciliation workflows
  • Test failure handling
  • Verify retry logic
  • Confirm production credentials
  • Enable monitoring systems
  • Review operational alerts

​
Security Recommendations

  • Never expose production secret keys
  • Restrict API access securely
  • Rotate credentials periodically
  • Validate all incoming webhooks
  • Maintain audit logs for compliance

​
Best Practices

  • Monitor transactions continuously
  • Validate payment and payout statuses server-side
  • Use idempotent transaction IDs
  • Implement retry-safe workflows
  • Maintain reconciliation systems
  • Handle webhook events asynchronously

​
Important Notes

  • Production transactions involve real money movement
  • Banking settlement delays may occur
  • Webhook delivery timing may vary
  • Final transaction validation should always happen server-side