Integration launch checklist

Access and authority

• CRISP approved your environment, supported regions, fee terms and support route.
• Backend-only scoped key; no CRISP admin/execution keys or DB access in your app.
• Exact frontend origins registered for realtime; webhook configured if used.
• Your BFF checks user authorization for every account-scoped action. Test a user trying to read/trade/claim/withdraw for another external ID and reject it locally.
• Your withdrawal UI confirms the exact destination/asset/amount before submission.
• Agreed/enforced request limits, bounded polling and backoff; no assumed RPS/SLA.

Lifecycle tests in the approved test environment

1. Provision and replay the same user: one managed account, wait until ready.
2. Fund with the exact supported token/network; verify final credit, not only source-chain transaction acceptance. Exercise unavailable-balance presentation.
3. Submit a small explicitly user-approved buy/sell, inspect pending/open/partial fills and canonical history. Do not equate a 202 with fill success.
4. Retry the same intent after a simulated transport timeout; confirm no duplicate order. Test fresh nonce, reused nonce, changed body and missing scopes.
5. Cancel an open order and redeem resolved win/loss positions with confirmation.
6. Attribute direct referrers before trades; verify configured levels, pinned rates, exact notional, allocations and missing-referrer behavior.
7. Accumulate multiple settled days, claim once, verify one batch payout and no duplicate funds on concurrent/repeated claims. No user-selected recipient.
8. Test approved withdrawal lifecycle including pending/manual-review presentation.
9. Disconnect/reconnect realtime, replay webhook IDs and exercise resync.
10. Confirm reports/payout totals without summing the same batch once per day.

Use an approved isolated environment and accounts. Do not run destructive reset scripts, deliberately ambiguous transfers or load tests on live wallets.

UI and operational acceptance

Keep unavailable distinct from zero, submitted distinct from filled, source confirmation distinct from destination delivery, and accrued distinct from paid out. Persist intent IDs before submit. Disable duplicate buttons without relying on them for financial security. Explain empty/loading/error/recovery states.

Before launch, CRISP and your team should record the tested source/deployment revision, enabled capabilities/scopes, lifecycle evidence and escalation owner. The current route inventory is not a complete machine-validated payload schema; coordinate unsupported/unclear fields before shipping. Ask CRISP about support and compatibility changes rather than relying on undocumented internal routes.