> ## Documentation Index
> Fetch the complete documentation index at: https://docs-provider.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Going-live checklist

> Everything to check before you switch to production.

## Checklist

* [ ] Your production partner is active and **API access** is `active` (`GET /partner/v1/api-access` in production).
* [ ] A **live key** (`vk_live_`) exists per system, with the minimum scopes it needs, and is stored in a secret manager, never in source code or a browser.
* [ ] Your secret scanners know the key format `^vk_(live|test)_[0-9a-hjkmnp-tv-z]{26}_[0-9A-Za-z]{43}$`.
* [ ] You know how to [roll a key](https://docs-provider.voucher.allride.io/guides/api-keys.md#rotate-a-key) without downtime, and who may do it.
* [ ] **IP allowlist** entries cover every IPv4 and IPv6 egress range of your systems, and enforcement is on (`api-keys` or `api-keys-and-users`).
* [ ] Every call uses `https://`; plain HTTP is refused and your key must never travel unencrypted.
* [ ] Your outbound firewall allows the API **hostname**, not IP addresses: the API host has no static inbound addresses (see [Network and IP addresses](https://docs-provider.voucher.allride.io/guides/network.md)).
* [ ] AllRide's **egress addresses** are allowed by the firewall in front of your webhook receiver (see [Network and IP addresses](https://docs-provider.voucher.allride.io/guides/network.md)).
* [ ] A production **webhook endpoint** is registered for the types you handle; your receiver verifies `x-signing-signature` against either of your two secrets and rejects timestamps older than 5 minutes.
* [ ] Your webhook handlers are **idempotent** (deliveries can repeat and arrive out of order) and answer 2xx within 15 seconds.
* [ ] Every POST sends an **Idempotency-Key**, reused for retries of the same intent.
* [ ] Your **retry policy** follows the [errors guide](https://docs-provider.voucher.allride.io/errors.md#retrying-safely): retry 5xx, `idempotency-key-in-use` and network errors with the same key; never retry other 4xx without changing the request.
* [ ] Clients **ignore unknown fields** and treat enums as open sets; 64-bit ids and counters are parsed without loss.
* [ ] Production voucher sets are created and their **change requests approved**; uploads ran in production, not only in the sandbox.
* [ ] **Stock alert** recipients are set for every active set.
* [ ] `contacts.technicalEmail` on your partner is a monitored mailbox (deprecation, network and sandbox notices go there).

## Related

* [Sandbox and production](https://docs-provider.voucher.allride.io/guides/environments.md)
* [Webhooks](https://docs-provider.voucher.allride.io/webhooks/overview.md)
* [IP allowlist](https://docs-provider.voucher.allride.io/guides/ip-allowlist.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.