# Going live

## Onboarding steps

1. **Agreement.** Sign the integration agreement and its data processing addendum.
2. **Sandbox access.** Your account manager issues sandbox clients and registers your technical contact (email and phone) for incident and deprecation notices.
3. **Build and test** against the sandbox, using the [simulator](/guides/sandbox.md) to drive every flow you integrate.
4. **Review.** Send the checklist below with sample logs. Wathiqaty usually reviews it within 3 business days.
5. **Production.** Production clients are issued, ideally with an IP allow-list. Register your production webhook endpoints.

## Checklist

- Tokens are cached and renewed, not requested per call.
- Every write you might retry sends an `Idempotency-Key`, and retries reuse it.
- Webhook signatures are verified on the raw body, timestamps older than 5 minutes are rejected, and events are deduplicated by `id`.
- Your webhook endpoint answers `2xx` within 10 seconds and processes the event asynchronously.
- A reconciliation job (change feed or bordereau) catches anything a missed webhook would leave behind.
- Money is parsed as a decimal type, never a binary float.
- You log the `X-Request-Id` you send (or `metadata.requestId`) with every call.
- Your client ignores unknown fields and unknown enum values, and answers `2xx` to unknown webhook event types.
- Secrets live in a secret manager, not in code or config files.
- Personal data from the API is stored and kept only as long as your policy administration requires (Egypt's Personal Data Protection Law 151/2020).

## Support

Write to your account manager or `api-support@wathiqaty.com` with the request id, the endpoint, the time and the environment. Production incidents affecting the API are announced to registered technical contacts.