Going live

You build against the test environment. Production is the same code with a different base URL and different keys.

Checklist

• New Ed25519 key pair for production — never reuse test keys.
• Private key and API key in a server-side secret store, not in source or a shared collection.
• Production egress IPs sent to Neo Wallet if you use an IP allowlist.
• Server clocks on NTP (the signature window is ±300 s).
• Every write persists its Idempotency-Key before sending, and retries reuse it.
• X-Request-Id logged on your side for every call.
• Webhook receiver verifies signatures on the raw body, dedups on dedupKey, answers in < 10 s.
• Webhook secrets stored by kid; rotation rehearsed in the test environment.
• Unknown response fields, error codes and webhook fields are ignored, not fatal.
• Amounts are integers in minor units end to end — no floats.
• A payout left processing is reconciled via GET /operations/{uid}, not assumed failed.

Testing every branch

In the test environment, payment providers are simulated. The test client portal lets you force the next payout to fail or stay unanswered, and trigger an incoming top-up payment — so every outcome in the flows is testable without real money.

Versioning

The path is the version: /api/v1. There is no version header.

Change	Ships as
New route, new optional request field, new response field, new error code	/api/v1, no notice needed
Anything your correct code would have to change to survive	/api/v2, alongside v1 for ≥ 90 days

Sunset dates are announced in the client portal and the changelog.