> For the complete documentation index, see [llms.txt](https://bify.gitbook.io/rwa-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bify.gitbook.io/rwa-docs/bify-commerce/integration-checklist.md).

# Commerce Integration Checklist

Use this checklist when connecting a partner storefront to BIFY Commerce.

## Partner Backend

* Store the BIFY API key and webhook secret only on the partner backend.
* Create checkout sessions from a trusted partner order snapshot.
* Use the partner order ID as the stable business reference.
* Generate a unique, repeatable idempotency key for each checkout attempt.
* Calculate the USDC amount in base units before creating the session.
* Keep fulfilment and inventory decisions in the partner system.

## Browser Integration

* Load the BIFY browser component only from an allowed partner origin.
* Pass only the session ID and short-lived client token to the browser.
* Do not expose partner API keys, webhook secrets, or encryption keys.
* Show the exact network, USDC contract, recipient, amount, order reference, and payment expiry to the customer.
* Treat browser confirmation as informational until the partner backend receives the signed settlement event.

## Webhooks and Reconciliation

* Verify the raw request body before parsing a webhook.
* Reject invalid, expired, and replayed signatures.
* Make event processing idempotent by event ID.
* Reconcile BIFY settlement state with the partner order before fulfilment.
* Record certificate and reward confirmations separately from the physical order state.

## Certificate and Reward Claims

* Keep certificate claims optional until the customer supplies a recipient wallet.
* Confirm the mint transaction before marking the certificate as issued.
* Validate reward eligibility, claim windows, holding periods, and campaign limits.
* Keep physical reward fulfilment in the partner's order and support systems.

## Security Review

* Confirm no secrets, raw customer details, or decrypted payloads are logged.
* Confirm customer details are encrypted at rest by the BIFY backend.
* Confirm product price, quantity, inventory, and fulfilment status are never trusted from the browser.
* Confirm the partner backend handles API failures without exposing provider responses or stack traces to customers.
* Test duplicate requests, expired sessions, invalid payment references, incorrect amounts, and duplicate webhooks.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://bify.gitbook.io/rwa-docs/bify-commerce/integration-checklist.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.