Go-live checklist

A short checklist to run through before your first real-money player session. Every item links back to where it's explained in full.

Credentials & secrets

[ ] Your provider tenant ID and HMAC secret are stored server-side only — never in a browser bundle, mobile app, or client-visible config. See Signing & authentication.
[ ] The secret is read from a secrets manager or environment variable, not committed to source control.

[ ] The server that signs requests (and verifies inbound webhooks) has its clock synced via NTP. A skewed clock is the most common cause of an otherwise-unexplained 401 — see Signing & authentication and Debugging.
[ ] baseUrl in your ProviderClient config points at the platform environment you mean to go live against — see Environments & base URLs.

[ ] Your game's launchBaseUrl is registered and resolves to your game's entry page.
[ ] If you support round replay, replayBaseUrl is registered — see Round replay.
[ ] If you implement the session-revoke or free-spins webhooks, the baseUrl those routes live at is registered with your integration contact.

[ ] POST /v1/game/session/revoke is implemented and verifies every call with verifyPlatformSignature before trusting the body — see Session revoke webhook.
[ ] POST /v1/game/free-spins/{grant,status,cancel} are implemented, also signature-verified — see Free spins webhook.
[ ] Each webhook route reads the raw request body for signature verification — no JSON-parsing middleware runs before verification.
[ ] Free-spins handling is idempotent on requestRef/externalRef — the platform does not retry these calls, so a follow-up call for the same batch must be safe to process again.

[ ] transactionId is generated once per logical attempt and reused verbatim on your own retries (the SDK already does this for its internal retries).
[ ] WIN is submitted as a transaction separate from its BET, with roundComplete: true on whichever ends the round.
[ ] currency is always sent as an uppercase 3-letter ISO-4217 code.
[ ] amount is always an integer in the currency's minor unit, never a float.
[ ] Your code treats 429 responses by honoring PlatformApiError.retryAfter before retrying — see Errors & retry.

[ ] You've run examples/smoke.ts (or an equivalent connectivity check) against the real platform, not just createMockPlatform — see Testing with createMockPlatform.
[ ] You've verified a session, submitted a BET/WIN pair, and queried a balance end-to-end against a DEMO-mode session before switching to REAL.