Skip to main content
Work through this page in sandbox. The Zapyd team reviews the same points before issuing production credentials.

​
Rules Zapyd enforces

Breaking these rules gets the order rejected, refunded or held. There’s no soft error.

​
Checklist

​
Customers and KYC

  • Customers are created with your client_reference_id, and you store the Zapyd id
  • Orders are blocked until the customer is VERIFIED
  • FAILED KYC shows the user what to fix, and only the failed part is resubmitted
  • A customer blocked after three attempts is handled

​
Payins

  • The rate, fees and receiving_amount shown come from the quotation
  • deposit_instructions come from each quotation and are never cached
  • The transfer reference is collected and sent as transaction_reference_id
  • Crypto is credited only on SUCCESS, never on ON_HOLD, FAILED or REFUNDED

​
Payouts

  • Asset, network and wallet_address are read from the quotation for every transfer
  • Per-order payouts are initiated with the matching transaction_hash
  • IN_REVIEW with an rfi_link sends the customer to answer it
  • The UTR from SUCCESS is shown to the user

​
Webhooks

  • The signature and the timestamp window are checked on every event
  • The endpoint returns 2xx fast and processes the event asynchronously
  • Events are deduplicated on id and event
  • Orders without a final status after a set time are polled, and you get an alert

​
Errors and operations

  • Signing passes the test vector in a unit test
  • Code branches on err_code, and only 429 and 5xx are retried, with backoff
  • Users never see raw err_code values
  • Requests, Zapyd IDs and responses for money-moving calls are logged

​
Security

  • The API secret lives in a secrets manager and never reaches a browser or mobile app
  • Widget Initialize runs server-side, and only widget_link reaches the client
  • Sandbox and production credentials are kept separate

​
Switch to production

Get production credentials

Share your sandbox results with the Zapyd team. After review, you get production keys.

Change the configuration

Change the host from sandbox.zapyd.com to api.zapyd.com. Swap the keys and the widget app_id. Move from Sepolia to mainnet networks. Register your production webhook URL.

Remove sandbox-only code

Remove the mock status calls and your test customers.

Run a small live order

Complete one small real order in each direction you support, then roll out.