Best practices

A short checklist that separates a demo from a production integration.

Do

Send an Idempotency-Key on every write — it makes retries safe.
Verify every webhook over the raw body and timestamp before acting.
Credit on the on-chain confirmation, not on a webhook or callback alone.
Reconcile against the status endpoint so a missed event never desyncs you.
Test the whole flow on testnet before switching to live keys.
Show amount, asset and network clearly at checkout — or use the hosted page, which already does.
Store keys as server-side secrets and rotate them periodically.

Trust a fiat on-ramp callback as proof of payment — wait for the on-chain deposit.
Re-serialise the webhook body before verifying its signature.
Put an API key in client-side code.