# Production checklist

1. HTTPS only; redirect HTTP to HTTPS.
2. Use an authorized bKash/Nagad/payment-service provider account and its official server-to-server APIs.
3. Put provider credentials in environment variables or server secrets, never in the repository.
4. Keep merchant secret keys server-side only.
5. Enable rate limiting on `/api/v1/*` and webhook endpoints.
6. Verify webhook signatures, amount, currency, merchant, and transaction state.
7. Make webhook processing idempotent; the current transaction lock prevents duplicate credit for an already-successful transaction.
8. Add a webhook delivery queue/retry worker for reliable merchant callbacks.
9. Do not treat a browser redirect as proof of payment.
10. Before launch, add KYC/AML, transaction limits, refund/chargeback procedures, audit logs, and applicable Bangladesh regulatory/provider requirements.
11. Test with provider sandbox first.