Production-readiness checklist

Fluveo does not currently issue sk_live_* or publishable keys. Every contracted /v1 operation is test-only. This is a promotion checklist, not an instruction to switch keys today.

Required before live mode

• Implement and certify atomic sk_live_* issuance, revocation, and mode isolation.
• Prove every object and list is partitioned by Fluveo merchant (mch_*) and test/live mode.
• Complete the money-safe idempotency and retry gates for every promoted mutation.
• Prove connector, vault, ledger, refund, reconciliation, and recovery paths with blocking evidence.
• Promote only operations present in canonical OpenAPI paths.
• Keep unsupported Events methods, WebhookEndpoints, and top-level PaymentMethods unavailable until their tenant-safe contracts pass the required tests. Events GET list/retrieve are already contracted-test.
• Verify redaction of secrets, PAN, CVC, client secrets, processor IDs, and internal headers from logs and artifacts.
• Run the official Stripe Node and Python SDK golden paths without a monkey-patched transport.

What integrations should do now

Use an issued sk_test_* key with https://api.fluveo.dev and call only operations in the generated API Reference. Do not place a secret key in browser code. Do not invent pk_* or sk_live_* credentials.

Review API coverage for unavailable and uncontracted surfaces.