Skip to main content

​
Checklist

  • Your production partner is active and API access is active (GET /partner/v1/api-access in production).
  • A live key (vk_live_) exists per system, with the minimum scopes it needs, and is stored in a secret manager, never in source code or a browser.
  • Your secret scanners know the key format ^vk_(live|test)_[0-9a-hjkmnp-tv-z]{26}_[0-9A-Za-z]{43}$.
  • You know how to roll a key without downtime, and who may do it.
  • IP allowlist entries cover every IPv4 and IPv6 egress range of your systems, and enforcement is on (api-keys or api-keys-and-users).
  • Every call uses https://; plain HTTP is refused and your key must never travel unencrypted.
  • Your outbound firewall allows the API hostname, not IP addresses: the API host has no static inbound addresses (see Network and IP addresses).
  • AllRide’s egress addresses are allowed by the firewall in front of your webhook receiver (see Network and IP addresses).
  • A production webhook endpoint is registered for the types you handle; your receiver verifies x-signing-signature against either of your two secrets and rejects timestamps older than 5 minutes.
  • Your webhook handlers are idempotent (deliveries can repeat and arrive out of order) and answer 2xx within 15 seconds.
  • Every POST sends an Idempotency-Key, reused for retries of the same intent.
  • Your retry policy follows the errors guide: retry 5xx, idempotency-key-in-use and network errors with the same key; never retry other 4xx without changing the request.
  • Clients ignore unknown fields and treat enums as open sets; 64-bit ids and counters are parsed without loss.
  • Production voucher sets are created and their change requests approved; uploads ran in production, not only in the sandbox.
  • Stock alert recipients are set for every active set.
  • contacts.technicalEmail on your partner is a monitored mailbox (deprecation, network and sandbox notices go there).