Go-live checklist

Summary: production needs a production key, a production webhook endpoint that receives order.status_changed, a clean sandbox run, and two steps on our side: a short check-before-ordering certification with you, then switching production on. The Go-live page of your partner portal tracks each item live.

What the Go-live page checks

Item	Owner	Done when
Production API key issued	You	You have an active production key (API Keys page).
Check-before-ordering certification	Axiom, with you	Axiom has recorded a sandbox session in which your checkout called POST /orders/check, stopped before payment for an order the check refused, and went on to payment for one it allowed. Production cannot be switched on for an API version 2 account without it.
Production webhook endpoint registered	You	At least one active production endpoint.
Subscribed to order.status_changed	You	An active production endpoint receives it. Without it you are not told when an order ships or its tracking number; you would have to poll.
Subscribed to order.failed	You	Recommended, so an order that cannot be filled does not go quiet.
A webhook delivered and accepted	You	One of your production endpoints has answered a delivery with 2xx.
Latest sandbox order is production-clean	You	Your most recent sandbox order passes the order-detail checks and the clinic agreement as production applies them. (It does not test credit limits.)
Production access enabled	Axiom	We have switched production on. Until then a production key gets 403 production_not_enabled.

Before you ask us to switch on

• [ ] Every request signs the method, path with query string, timestamp and exact body. See Authentication and signing.
• [ ] Each create carries one key per logical order, the same in the header and the body, reused on every retry. See Idempotency.
• [ ] Your checkout calls POST /orders/check and only takes payment when wouldAccept is true.
• [ ] You send shipping_method explicitly.
• [ ] You send the structured prescriber fields (first_name, last_name, credential, phone, practice address) and the patient's sex and phone.
• [ ] Clinics are enrolled with their attestation, if your account is partner-attested. See Clinics and agreements.
• [ ] Webhooks are verified on the raw body and acknowledged within 20 seconds. See Webhooks.
• [ ] Your code handles every refusal in Errors and rate limits, backs off on 429 and 503, and logs our X-Request-Id.
• [ ] You worked through the sandbox test plan.
• [ ] Secrets live in a secret store, not in code or logs, and you know how to rotate a key.

Day one in production

• Place one real order you are prepared to have filled, and watch it on the portal's Requests and Deliveries pages.
• Confirm order.status_changed arrives at your production endpoint and that your verification accepts it.
• Reconcile once a day: re-read with GET /orders/{id} every order from a recent window, whatever its status (statuses can change after delivered, cancelled or failed; the list's since filters on creation time, not on change), and use changedSince on the billing feed for money.