# Go-live checklist

> What to check before you switch your integration to production.

Source: https://docs.delivr.no/go-live/

Run through this list with your sandbox integration before you ask Delivr for production keys.

## Orders

- [ ] Every write sends a new `Idempotency-Key` per action and reuses it on retry. See [Idempotency](/conventions/idempotency/).
- [ ] Your order system stores Delivr's `id` and `reference` next to your own order id (`externalRef`).
- [ ] You handle `409 price_changed`, `409 option_unavailable` and `409 window_full` when an order is placed on an older quote. See [Quotes and orders](/guides/quotes-and-orders/).
- [ ] Each order has a recipient name and phone in `delivery.contact`, so the recipient gets the tracking SMS.
- [ ] Parcels are declared with a realistic weight and size, or your stores have a `defaultParcel`.

## Stores

- [ ] Every store is a [location](/guides/locations/) with the right address, contact phone and `pickupInstructions`.
- [ ] Each store's `readySignal`, `prepMinutes` and `readyDeadlineMinutes` match how it really works.
- [ ] If a store uses `readySignal: required`, its staff or system sends `processing` or `ready` for every order.

## Webhooks

- [ ] Your endpoint is public HTTPS and answers `2xx` within 15 seconds, doing slow work afterwards.
- [ ] You [verify every signature](/webhooks/signatures/) and reject old timestamps.
- [ ] You deduplicate on the event `id`, and apply `data` only when its `version` is newer than what you have.
- [ ] You create orders in your system on `order.placed` only.
- [ ] A nightly job reads `GET /v1/merchant/orders?updatedSince=…` to catch anything missed.

## Statuses and failures

- [ ] You handle every status and reason in the [order lifecycle](/guides/order-lifecycle/), including `failed` with `no_driver` and `goods_not_ready`.
- [ ] Your customer service knows what your [fallback policy](/guides/fallbacks/) does when an on-demand order fails.
- [ ] Cancellations send `maxFeeMinor` when you only want to cancel free of charge. See [Cancelling](/guides/cancelling/).

## Operations

- [ ] Logs keep the `X-Request-Id` of every call, so you can quote it to Delivr support.
- [ ] Unknown response fields and event types are ignored, not errors. See [Versioning](/conventions/versioning/).
- [ ] API keys live in a secret manager, and only on servers.

When everything is ticked, email your Delivr contact with your sandbox merchant name. You get production keys, the production base URL and your webhook secret.