Integration Checklist · GrowthBnk Developers

Credentials & Access

API Keys obtainedSandbox key + salt loaded from environment config.IP whitelist configuredYour server egress IPs added if whitelisting is enabled.Modules enabledPayment orchestration (and reconciliation if used) active on the account.

URLs

Webhook URL configuredPublic HTTPS endpoint that verifies the signature and returns 200.Return URL (surl) setSuccess redirect back to your site.Redirect URL (furl) setFailure redirect back to your site.

Security

Hash verification implementedCorrect per-endpoint formula, constant-time compare.Webhook validation implementedSignature verified before acting on any event.Secrets stored securelySalt in env/secret manager, never in client code or git.

Reliability

Retry logic with backoffBounded retries + exponential backoff + jitter on transient errors.Idempotent order IDsUnique merchant_transaction_id per order.Duplicate callback handlingDeduplicate by transaction_id; idempotent processing.Timeout handlingExplicit timeouts; reconcile before retrying a timeout.

Observability

Monitoring in placeSuccess rate, webhook delivery, error rates.Logging of request/transaction IDsNo secrets logged.Error handling implementedBranch on HTTP status + message; surface actionable errors.

Verification

Settlement verificationReconcile settlements against transactions.Refund testingFull and partial refunds exercised in sandbox.Duplicate prevention verifiedReused order id is rejected; retries do not double-charge.