Appearance
Go-live checklist
What has to be true before each Mamlaka product carries real money for the exchange. "Built" means the exchange already does it and it is covered by tests; the rest are steps for the people involved.
Payment gateway
| Item | Owner | |
|---|---|---|
| ☐ | Sandbox merchant created; merchant id and API password entered on the exchange's server | Mamlaka ops, exchange operator |
| ☐ | Sandbox callback signing secret set for the merchant and entered on the server | Mamlaka ops, exchange operator |
| ☐ | Sandbox run: an STK push to the success test number confirms an invoice payment; the failure test number fails it | Exchange operator |
| ☐ | Sandbox run: a card payment on the hosted page with a test card, with and without a 3-D Secure challenge | Exchange operator |
| ☐ | Sandbox run: a B2C payout after two approvals | Exchange Finance |
| ☐ | Live merchant created, with card profile (KES; USD if enabled), paybill and B2C float | Mamlaka ops |
| ☐ | Live callback signing secret set and entered on the server | Mamlaka ops, exchange operator |
| ☐ | First live collection and first live B2C for a small amount, checked against the Mamlaka dashboard | Exchange Finance |
| ✓ | An externalId stored before every call and reused on retry | Built |
| ✓ | Timeouts, 5xx and 202 held as Unknown, never refunded | Built |
| ✓ | Every outcome read back with GET /transaction; callbacks only prompt a read | Built |
| ✓ | A poller for payments whose callback never came | Built |
| ✓ | Sandbox limited to the gateway's test numbers | Built |
Virtual cards
| Item | Owner | |
|---|---|---|
| ☐ | Partner API key and webhook signing secret entered on the server only | Exchange operator |
| ☐ | Card webhook address registered with Mamlaka | Mamlaka ops |
| ☐ | KES float funded | Exchange Finance |
| ☐ | First cardholder: a named driver, with consent recorded, passes KYC | Exchange Fleet |
| ☐ | First card issued and loaded; balance checked against Mamlaka | Exchange Finance |
| ✓ | An Idempotency-Key on every action, reused on retry | Built |
| ✓ | A quote taken before every issue and load | Built |
| ✓ | Webhook on HTTPS, signature checked over the raw body, each event acted on once | Built |
| ✓ | Polling fallback for KYC, cards and operations | Built |
| ✓ | KYC fields and files checked before they are sent | Built |
| ✓ | Card number and CVV never shown or stored | Built (by design, there is no screen for them) |
| ☐ | An alert to Finance when the float runs low (today it is shown on Fleet → Driver cards) | Planned |
For the exchange
| Item | |
|---|---|
| ☐ | The two Finance users who approve payments out are named, and each has their own sign-in |
| ☐ | The money-rails release is on the server, with a database backup taken first |
| ☐ | GET /health names each rail that is switched on |