Go-live checklist

In the sandbox

Use the sandbox host (https://stagingvault.megtrust.com) and a sandbox key to confirm each item:

• Key registration — your public key is registered and you have its Key ID.
• A signed read — GET /api/v1/wallets returns 200.
• A foreign-wallet 404 — GET /api/v1/wallets/{id} with an id that is not yours returns 404 wallet_not_found.
• Deposit addresses — your UI shows deposit_addresses[] by exact network, never the top-level address.
• Destination — a destination registered through the API shows can_send: true once verified.
• Payout retry recovery — a payout retried with the same Idempotency-Key returns meta.idempotent_replay: true, and you can find it with GET /withdrawals?idempotency_key=….
• Required approvals — your organisation's approvers approve a sandbox payout, and you follow it to completed with GET /withdrawals/{id}.
• Cancel — cancelling a payout still pending_approval returns cancelled; your code handles 409 withdrawal_not_cancellable.
• Final settlement — you store tx_hash and never show "sent" on a 202.
• Reconciliation — you page GET /transactions with meta.next_cursor until it is null.
• Webhook receiver — deliveries verify, deduplicate by event.id, and return 2xx within 10 seconds.
• Errors — your code branches on error.code, honours Retry-After, and re-signs every attempt.

In production

• Generate a separate production keypair and register it in the production console.
• Repeat the read-only authentication check against https://vault.megtrust.com with the production key.
• Register your production webhook receiver and store its secret.

The supplied client's own checks do not prove that your deployment's credentials, approval policies, network funding or webhook receiver are configured. Only the steps above do.