Going live checklist
Everything that should be true before your first production settlement, grouped by the thing it protects. Most of it is one-time; the last group is what you keep doing afterwards.
Two items are sequencing traps rather than tasks: deploy the production key before you rotate anything, and register production webhook endpoints before you promote agents. Both are cheap to do in the right order and disruptive to fix afterwards.
Account and accreditation
ACCREDITED Read status from GET /v1/platform. Do not infer it from having received a key.
It appeared once, in the promotion response. It should already be in your server configuration before any traffic switches — never in client-side code, never in a repository.
The legal name and country are what your documents were checked against. Divergence surfaces later as questions you will have to answer.
Verification decisions, security notices, and account changes go there. A personal inbox that stops being read is a slow outage.
Credentials
Nustro holds only a hash and cannot recover it. Losing it means rotation, and rotation revokes immediately.
Agents authenticate per request with their own certificate and proof. A management key in an agent process authenticates your whole platform from a machine you may not fully control.
They were delivered once at activation. Your platform does not need them and should not hold them.
There is no overlap window. Write down the order — deploy, then rotate — before you need it under pressure.
Webhooks
Environment is fixed at creation, so sandbox endpoints receive nothing from production. This is the most common launch-day surprise.
Not the code path — an actual signed delivery, verified with the production secret, in the production handler.
Nustro-Event-Id Delivery is at-least-once. A handler that credits twice on a redelivery is a receiver bug.
platform.verification_decided is subscribed The one event with no good polling alternative.
Path find/replace /v1/customer → /v1/platform, then hand-fix the profile status read and the platform.verification_decided event string. Old paths return 404.
Re-serialising a parsed object produces different bytes and a signature that never matches.
Agents
Markets do not carry across environments. Each production agent needs its markets set with the wallets for whichever networks those markets use.
An agent promoted with unfunded escrow lands in FUNDING. Check per agent rather than assuming.
Spend ceilings, windows, counterparty floors, and dispute windows were often set to permissive values during integration. Review them before real money moves.
Discover, negotiate, settle, facilitate, confirm. Verify the split on-chain and the webhook in your own system before promoting the rest.
What your principals can see
These are not protocol requirements. They are the four things that generate support load when they are missing.
One field. It converts “trust our numbers” into “check them.”
A counterparty who does not know they can dispute will not, and one who does not know a sale was final will ask you why they cannot.
A principal who discovers the threshold through a suspension will ask you to remove it.
“Declined” with no reason is a support ticket every single time.
Ongoing, after launch
Expiry suspends every agent under the principal, automatically and without grace. You hold the relationship, so only you can start this in time.
The one exposure signatures do not cover.
A sustained failure run disables an endpoint. Silence from a webhook is indistinguishable from nothing happening.
Push tells you something changed; pull tells you what is true.
It answers “why did this stop working” faster than anyone can reconstruct it.
Promotion does not close your sandbox. Keep integrating, testing upgrades, and reproducing support issues there — a production environment used as a test environment is how launch-day discipline erodes.