Going live checklist

Before you switch your integration to production:

• Switch the base URL to production: https://api.safehavenmfb.com.
• Create a production OAuth app and generate new keys on the production dashboard (https://online.safehavenmfb.com).
• Set your production webhook URL on the dashboard.
• Use a unique paymentReference / externalReference value for every request.
• Always read statusCode in the response body. A request can return HTTP 200 or 201 with "statusCode": 400 in the body. See Errors.
• Pass fromDate and toDate when listing transactions. Without them, only the current calendar month is returned.
• Add your production server IPs to your OAuth app's IP allowlist, if you use one.
• Refresh your access token before it expires (access tokens last 40 minutes).
• Stay under 1500 requests per minute per IP address.
• Handle "statusCode": 202 ("Processing") on transfers. See Transfer.
• Make webhook handling idempotent: the same event can arrive more than once.