Go-live Checklist

Complete this checklist before switching production traffic on.

Environment and access

• Production App Key and App Secret are issued and stored only in a secrets manager.
• Production outbound IP addresses are allowlisted.
• The application is active and authorized for G-Link Hotel API.
• Production base URL, callback URL, and HTTPS certificates are confirmed.

Security and reliability

• HMAC signing uses the exact public API path and raw request body.
• Server time is synchronized; nonce generation is unique.
• Order creation and payment include an idempotency key.
• The callback handler validates requests and is idempotent.
• request_id and trace_id are logged and searchable.

Business validation

• Destination search, hotel detail, and real-time products have been verified.
• Availability is checked immediately before every order creation.
• Payment, confirmation, cancellation, and missing-callback compensation are tested.
• The system handles price change, inventory exhaustion, and cancellation-policy outcomes.
• Monitoring and support escalation ownership are agreed.

Sandbox and production credentials are separate. A successful sandbox result does not activate production access.