Skip to main content
Work through this list before you switch your integration from the sandbox to production. Each item links to the guide that explains it.

​
Checklist

Account and access
  • Your production consumer partner exists and its API access is active (GET /partner/v1/api-access shows "status": "active").
  • A production vk_live_ key exists for each system that calls the API, with the minimum scopes it needs, stored in a secret manager and never in code or logs (API keys, Permissions and scopes).
  • You have a plan to rotate keys with :roll before they expire.
  • Your technical contact (contacts.technicalEmail on the partner record) is current: key expiry warnings and deprecation notices go there.
Network security
  • Your outbound IPv4 and IPv6 ranges are on the IP allowlist and enforcement is on (IP allowlist).
  • Your client calls the API only over https:// with TLS 1.2 or newer and validates the server certificate against your system trust store, without pinning it (Network and IP addresses).
  • Your outbound firewall (if any) allows the API by hostname, not by IP address: the API hosts are served through Cloudflare and have no static inbound addresses (Network and IP addresses).
  • All four of AllRide’s egress addresses, including the two disaster-recovery addresses, are allowed by the firewall in front of your webhook receiver (and your SMTP server, if you use email OTP links) (Network and IP addresses).
Webhooks
  • A production webhook endpoint is registered for the event types you handle (Webhooks).
  • Your receiver verifies x-signing-signature against either of your two secrets, over the raw body, and rejects old timestamps (Verifying signatures).
  • Your handlers are idempotent: deliveries can repeat and arrive out of order.
  • Your receiver answers 2xx within 15 seconds and does the work afterwards.
Requests
  • Every POST sends an Idempotency-Key, and retries reuse the key of the same intent (Idempotency).
  • Your retry policy follows the errors guide: retry 5xx, network errors and the retryable conflicts with the same key, and an edge 429 after Retry-After; never retry other 4xx without changing the request.
  • Your client ignores unknown fields and treats enums as open sets (Versioning and deprecation).
  • Your JSON parser handles ids and counters above 2^53 (Requests and responses).
  • You log the X-Request-Id of failed calls so that support can trace them.
Business setup
  • The Price Terms of the voucher sets you offer are accepted in the production consumer dashboard (Prices and price acceptance).
  • Your Provider Toggles and Voucher Set Toggles are set (Catalog and toggles).
  • Your billing account, billing contacts and payment method are complete (Billing).
  • If you use Redemption Links: Workspace Branding with landing.privacyUrl and landing.imprintUrl set (required before you can create links; landing.termsUrl is optional, see Landing pages), an active custom domain if you want one, and for email OTP links a verified SMTP configuration with an active template.
Staying informed
  • contacts.technicalEmail on your partner is a monitored mailbox (deprecation, network and sandbox notices go there).