Reference
Go-Live Checklist
Work through this before sending real customer traffic through a live API key. Every item here maps to a specific incident this platform has actually had — this isn't generic advice.
Credentials
- Generate a live API key from the Merchant Portal (API Keys → Live) with only the scopes your integration actually uses.
- Store the key in your backend's secret manager or environment variables — never in a repo, a mobile app bundle, or any frontend/client-side code.
- Set a webhook secret (Merchant Portal → Webhooks, or PATCH /v1/merchant/webhook-config with regenerate_secret) and store it the same way.
Integration
- Every write request sends a fresh Idempotency-Key per genuine user action (not per HTTP retry of the same action).
- Your order-paid logic only triggers on collection.successful (webhook) or status: "successful" from GET /v1/collections/{id} — never on created, processing, pending_clearance, a QR/token being returned, or a push's initial resultcode.
- Your webhook endpoint verifies X-Infinity-Signature on every delivery before trusting the payload.
- Your webhook handler responds quickly (do slow processing asynchronously) and treats deliveries as idempotent — keyed off collection_id.
- You've tested Send Test Webhook from the Merchant Portal against your real endpoint.
- You handle collection.failed, collection.reversed, and collection.pending_review distinctly from collection.successful in your own order state — a reversal after credit is a real scenario, not an edge case to ignore.
Selcom account
- Confirm with Selcom which of Mobile Money Push / Selcom Pesa / Scan QR your account is actually provisioned for — Hosted Checkout is currently inactive platform-wide (see below), don't build against it.
- Test with a small real amount on a phone/account you control before sending real customer traffic.
Compliance & security
- Merchant KYC/onboarding is approved (see Merchant Onboarding Requirements).
- HTTPS only — for your webhook endpoint and everywhere you call the Infinity Africa API from.
- No Infinity Africa or Selcom credential appears in any frontend bundle, mobile app package, or public repository.
Security best practices
warning
Never ship a secret key to anywhere a customer's device can read it
An API key or webhook secret in a browser bundle, a mobile app package, or a public repository can be extracted by anyone. Keep both server-side; have client apps call your own backend, and have your backend call Infinity Africa.
A few more that matter in practice:
- Rotate a key immediately if you suspect it leaked — Rotate on the API Keys page revokes the old one and issues a replacement with the same scopes in one action.
- Scope each key to only what it needs (collections:write for a checkout server doesn't need transactions:read).
- Verify every webhook signature — an unsigned or wrong-secret delivery should be rejected, not processed.
- Log request IDs / collection IDs, not full request/response bodies, if your logs might ever be shared for support — avoid retaining customer phone numbers longer than you need to.
Hosted Checkout is not available
Selcom's hosted checkout redirect (payment_gateway_url) is currently inactive platform-wide — it returned "Page Not Found" for every order tested. Don't build an integration that redirects a customer there. Use the Infinity Payment Page flow instead — it offers the same "you don't pick a channel" experience via Infinity's own page, backed by the three active methods (Mobile Money Push, Selcom Pesa, Scan QR / TanQR).