Go live
Before production, configure the production base URL and a production-only API key
in your server-side secret manager. Verify the tenant binding with /b2b/whoami.
Go-live checklist
Section titled “Go-live checklist”- The API key is never sent to a browser, device, or WebView.
- Catalog is refreshed before each new purchase decision.
- Every purchase has a durable, client-generated
Idempotency-Key. - A timeout or
5xxis retried with the exact same key and body. - Your service reads the purchase before attempting any manual recovery.
- Wallet availability is monitored before purchase attempts.
- Fulfillment credentials and coupon codes are treated as sensitive data.
- Support logs retain the RewardOS
requestId, purchaseorderId, and your idempotency key.
The B2B v1 contract does not include outbound webhooks. Plan reconciliation around purchase reads until an approved webhook contract is provided.
