> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matambaintelligence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Go-live checklist

> What to check before you switch from the sandbox to live keys.

Work through this list in the sandbox. Each item links to the page that explains it.

## Requests

* Every order, application and allocation has its own `Idempotency-Key`, saved before you send the request and reused on every retry. See [Idempotency](/idempotency).
* After a timeout or a `5xx`, your code retries with the same key and never a new one.
* Your code branches on `error.code`, never on `message`. See [Errors](/errors).
* You handle `429 rate_limited` by waiting `Retry-After` seconds, and `422 limit_exceeded` without retrying. See [Limits](/limits).
* You log the `x-request-id` header of every response.
* You hold amounts as integers in kobo, and read `average_cost_kobo_decimal` as a decimal string, never as a floating-point number.

## Orders

* You send limit orders only for ETFs. See [Orders](/orders).
* You handle every order state, including `uncertain`, and you don't place an uncertain order again under a new key. See [Handling uncertain orders](/handling-uncertain).
* You handle `409 similar_order_unresolved`.
* After a cancel returns `202`, you wait for `order.cancelled` or `order.filled` before you treat the order as finished.

## Events

* You've sent us your webhook URL, and we've sent you its signing secret. See [Webhooks](/webhooks).
* Your endpoint verifies every signature and rejects timestamps more than 5 minutes from your clock.
* Your endpoint returns `2xx` within 10 seconds and does the work afterwards.
* You ignore duplicate events by `webhook-id`, and stale ones by `version`.
* You store the last `next_cursor` from `GET /v1/events` and catch up from it after any downtime.
* You ignore event types, states and fields you don't recognise. See [Versioning](/versioning).

## Live access

* You've sent us every IP address or range your servers send requests from. See [Keys and security](/keys-and-security).
* Your live key is in a secrets manager on your servers, and never in an app or web page your customers download.
* You know how to reach us to revoke a key at once.
* You've agreed your limits with us, and how your wallet is funded. See [Wallet](/wallet).
* You've pointed your integration at the live host. Live and sandbox keys each work only on their own host.