> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.fluveo.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.fluveo.com/_mcp/server.

# Production-readiness checklist

> Fluveo does not currently issue `sk_live_*` or publishable keys. Every
> contracted `/v1` operation is test-only. This is a promotion checklist, not an
> instruction to switch keys today.

## Required before live mode

* [ ] Implement and certify atomic `sk_live_*` issuance, revocation, and mode
  isolation.
* [ ] Prove every object and list is partitioned by Fluveo merchant (`mch_*`) and
  test/live mode.
* [ ] Complete the money-safe idempotency and retry gates for every promoted
  mutation.
* [ ] Prove connector, vault, ledger, refund, reconciliation, and recovery paths
  with blocking evidence.
* [ ] Promote only operations present in canonical OpenAPI `paths`.
* [ ] Keep unsupported Events methods, WebhookEndpoints, and top-level
  PaymentMethods unavailable until their tenant-safe contracts pass the
  required tests. Events GET list/retrieve are already contracted-test.
* [ ] Verify redaction of secrets, PAN, CVC, client secrets, processor IDs, and
  internal headers from logs and artifacts.
* [ ] Run your integration's golden paths as plain HTTP calls to `/v1`
  (form-encoded bodies; `Authorization`, `Idempotency-Key`, `Stripe-Version`
  headers only) and check every response field you read against the
  [API Reference](/api-reference). SDKs are not supported.

## What integrations should do now

Use an issued `sk_test_*` key with `https://api.devfluveo.com` and call only
operations in the generated [API Reference](/api-reference). Do not place a
secret key in browser code. Do not invent `pk_*` or `sk_live_*` credentials.

Review [API coverage](/api-coverage) for unavailable and uncontracted surfaces.