Application readiness
Use distinct sandbox and live credentials, preserve idempotency, verify webhooks, handle every public error class, redact sensitive data, and pass integration and recovery tests.
Developer preview API v1
Sandbox only. No real funds moved. No production access is granted here. Access requirements
SC-2 activation gate
Prove the exact integration is safe to activate
Production authority is explicit, country-scoped, independently approved, and revocable.
Business and country authority
Confirm aggregator programme, merchant, country-cell, provider, currency, rail, funds-flow, fees, settlement, compliance, and residual-risk approvals.
Operational readiness
Approve capacity evidence, telemetry, alert ownership, reconciliation, support escalation, rollback, stop controls, and dependency-degradation runbooks before any live activation.
Activation is separate
Completing this checklist is necessary but does not grant production access. PAP records an explicit, independently approved activation decision for the exact app, tenant, aggregator programme, country, and provider set. PAP-owned programs receive no exception.