Production Readiness Checklist
- Use HTTPS for all public merchant and webhook URLs.
- Keep API token and webhook secret on backend only (never in browser source).
- Use unique merchant_reference/order_id per payment attempt.
- Store transaction_id, amount, currency, account number, and timestamps for audit.
- Implement idempotent webhook handling to prevent duplicate status updates.
- Apply retry with backoff for create/status calls on timeout or transient errors.
- Set clear return pages for payment-success and payment-failed outcomes.
- Run daily reconciliation between local order table and Paradise payment status.
Security Anti-Patterns to Avoid
- Do not place API tokens in JavaScript bundles, public repos, or browser local storage.
- Do not mark order paid from client-side success screens alone.
- Do not trust webhook payload without signature verification.
- Do not reuse merchant_reference/order_id across multiple distinct attempts.
- Do not skip audit logging for status changes and webhook receipt metadata.