# Onboarding Checklist
source: https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/onboarding-checklist/index.md

## Move from Sandbox to Production with Ethoca Alerts for Merchants {#move-from-sandbox-to-production-with-ethoca-alerts-for-merchants}

This checklist guides you from completed Sandbox testing through successful production enablement. It covers contract signing, technical validation, production key generation, and go-live confirmation. Following these steps ensures a smooth transition to live alert processing with Ethoca Alerts for Merchants.
> **Note on SLAs:** Production enablement timelines vary based on your organization's compliance requirements and current queue. The SLAs listed below represent standard processing. Urgent requests may be expedited in coordination with your Mastercard account manager.

*** ** * ** ***

## Prerequisites {#prerequisites}

Before beginning this workflow, confirm that all of the following are true:

* Your integration has completed all positive and negative test scenarios in the Sandbox environment with a **100% success rate**.
* You have documented your integration workflow including: which delivery model (Push, Pull, or both) you selected; which integration patterns you implemented (see [Use Cases](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/use-cases/index.md)); and any custom business logic for alert acknowledgement or outcome submission.
* Your technical team and business stakeholders have reviewed and approved the integration for production use.
* You have confirmed that your organization's security, compliance, and legal teams have no outstanding concerns about the Ethoca integration.

*** ** * ** ***

## Step 1: Submit Contract and Compliance Documentation {#step-1-submit-contract-and-compliance-documentation}

Your organization and Ethoca must sign a Service Agreement or Data Processing Addendum (DPA) before production credentials can be issued. This step also confirms business registration and compliance status.

During this step, provide your organization's business details (legal entity name, address, business type, primary contact information), confirm data residency requirements, and confirm that your organization complies with applicable data protection regulations (GDPR, CCPA, PCI-DSS if applicable). Your Mastercard account manager or Ethoca Customer Delivery Team will guide you through the specific documentation required; there may be additional KYC (Know Your Customer) or compliance reviews depending on your region and business model.

* **Artifacts needed:** Executed Service Agreement or DPA; completed business registration form; evidence of data protection compliance (for example, privacy policy, data controller attestation)
* **SLA:** 3--5 business days for contract review and execution

This step is complete when your executed agreement has been received by the Ethoca Customer Delivery Team and a production enablement ticket has been created with a ticket ID assigned to your organization.

*** ** * ** ***

## Step 2: Conduct MTF (Merchant Test Facility) Validation {#step-2-conduct-mtf-merchant-test-facility-validation}

The Ethoca team will create merchant records for your organization in the Merchant Test Facility (MTF) --- a staging environment that mimics production configuration and behavior. You will run your full integration test suite against MTF to validate that your integration works correctly with production-equivalent alert volumes and data patterns.

During this step, retrieve test alert templates from the Ethoca Customer Delivery Team and run your complete alert retrieval, acknowledgement, and outcome submission workflow in MTF. If you selected the Push delivery model, register your webhook endpoint with the MTF environment and confirm that Ethoca can successfully deliver test alerts to your endpoint. Validate that your error handling works correctly and that your system gracefully handles edge cases (for example, bulk alert volume, network latency, malformed payloads). Your test team will sign off on the MTF validation results.

* **Artifacts needed:** MTF test execution report (test case count, pass/fail summary, any failures noted and resolved); webhook registration confirmation (if Push model); signed MTF sign-off form from your testing team
* **SLA:** 5--7 business days for MTF environment provisioning and testing

This step is complete when your integration passes all MTF tests and the CIS (Compliance \& Integration Services) team has signed off on your MTF validation report.

*** ** * ** ***

## Step 3: Request Production Credentials and Technical Promotion {#step-3-request-production-credentials-and-technical-promotion}

With contract execution and MTF validation complete, submit a formal production enablement request to the Ethoca Customer Delivery Team. This request triggers credential generation (Production OAuth 1.0a consumer key and `.p12` keystore) and technical setup of your merchant profile in the production environment.

During this step, provide a Certificate Signing Request (CSR) with your organization's details (organization name, common name, country). The CSR is required to generate your Production `.p12` keystore. See [API Basics](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/api-basics/index.md#how-to-consume-the-api) for CSR generation instructions. Confirm your Production webhook URL (if using Push model), confirm your merchant configuration preferences (Push, Pull, or both delivery models), and confirm your technical contact and support escalation email addresses. The Ethoca team will generate your Production credentials and provision your merchant record in the production environment.

* **Artifacts needed:** Certificate Signing Request (CSR); production webhook URL (if Push model); confirmation of delivery model selection (Push, Pull, or both); technical contact name, phone, and email; support escalation email address
* **SLA:** 2--4 business days for Production credential generation and technical provisioning

This step is complete when your Production OAuth 1.0a consumer key and `.p12` keystore file have been securely delivered to your technical contact (typically via encrypted email or secure portal download), and the Ethoca team has confirmed that your merchant profile is provisioned and active in the production environment.

*** ** * ** ***

## Step 4: Configure Production Credentials and Deploy {#step-4-configure-production-credentials-and-deploy}

Download your Production credentials (consumer key and `.p12` keystore) from the secure delivery channel. Store them securely in your production environment using a secrets manager (for example, AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) or encrypted configuration system. **Do not** commit credentials to source control. Update your production configuration to point to the Production base URL (`https://api.ethocaweb.com/ethoca/alerts/merchants`).

During this step, conduct a final pre-production validation: verify that your production environment can successfully authenticate to the Production API using the new credentials; make a test call to each endpoint (for example, `GET /alerts`, `POST /alerts/acknowledges`, `POST /outcomes`); verify that alert retrieval returns live production data (after alerts have been submitted by issuers). If using Push, confirm that your production webhook endpoint is reachable and returns HTTP 200 OK responses. Test your error handling one more time to ensure your production system handles unexpected errors gracefully. Deploy your production integration to your production environment.

* **Artifacts needed:** Production credentials securely stored in secrets manager; updated production configuration pointing to Production base URL; final pre-production validation test results showing successful authentication and test API calls
* **SLA:** 1--2 business days (self-service; no Ethoca approval required)

This step is complete when your production environment is deployed, pre-production validation tests pass, and your technical team confirms readiness to accept live alerts from Ethoca.

*** ** * ** ***

## Step 5: Enable Production Traffic and Confirm Go-Live {#step-5-enable-production-traffic-and-confirm-go-live}

Notify your Ethoca Customer Delivery Team that your production environment is ready to receive alerts. The team will enable production traffic to your merchant profile, which activates live alert delivery to your system. Confirm with Ethoca when live production traffic has been enabled.

During this step, monitor your production system closely for the first 24--48 hours: watch for alert receipt, acknowledge receipt within expected SLAs (target: within 24 hours of alert arrival), submit outcomes, and log any anomalies. Your Ethoca Customer Delivery Team will monitor your system from their side as well and will alert you to any issues (for example, repeated webhook failures, authentication errors, API errors).

* **Artifacts needed:** Final confirmation from your technical team that production environment is deployed and monitoring is active; communication to Ethoca Customer Delivery Team confirming readiness for live traffic
* **SLA:** Same business day (after Ethoca team receives production readiness confirmation)

This step is complete when live production alerts begin arriving in your system, you have successfully acknowledged and processed at least one production alert, and both your team and the Ethoca Customer Delivery Team have confirmed that the integration is operating normally.

*** ** * ** ***

## Escalation Paths {#escalation-paths}

If you encounter issues or delays during onboarding, escalate using the following channels in order:

1. **Primary Contact:** Email your assigned Ethoca Customer Delivery Team member with your ticket ID, a description of the issue, and any error messages or logs. Expected response: 24 business hours.

2. **Escalation Lead:** If you do not receive a response within 24 hours, email the primary escalation contact provided by your Mastercard account manager. Include your ticket ID, timeline of prior communications, and issue description. Expected response: 4 business hours.

3. **Urgent SLA Escalation:** If you are blocked from going to production and have waited more than 48 hours, send an urgent escalation email to the Ethoca Support escalation queue (provided during onboarding). Include: your organization name, ticket ID, brief description of the production blocker, expected go-live date, and business impact. Expected response: 2 business hours; escalations are reviewed daily by management.

*** ** * ** ***

## Contact Information {#contact-information}

**Production Enablement Requests:**

* Contact your assigned Ethoca Customer Delivery Team member, or email the general production enablement inbox: [productionenablement@ethocaweb.com](mailto:productionenablement@ethocaweb.com)
* Include: Organization name, ticket ID (if you have one), project description, and technical contact information.

**Support During Onboarding:**

* Mastercard Developer Support Portal: <https://developer.mastercard.com/support>
* For urgent issues during the onboarding week, contact your assigned Mastercard account manager directly.

*** ** * ** ***

## Timelines Summary {#timelines-summary}

|              Step              |         Duration         |                                     Notes                                      |
|--------------------------------|--------------------------|--------------------------------------------------------------------------------|
| Step 1: Contract \& Compliance | 3--5 business days       | Includes legal review and KYC if required                                      |
| Step 2: MTF Validation         | 5--7 business days       | Includes environment provisioning; your testing is concurrent                  |
| Step 3: Production Credentials | 2--4 business days       | Credential generation and technical provisioning                               |
| Step 4: Deploy \& Validate     | 1--2 business days       | Self-service; no approval required; you control deployment schedule            |
| Step 5: Go-Live                | Same business day        | Live traffic enabled upon your confirmation of readiness                       |
| **Total Typical Timeline**     | **14--23 business days** | Assumes no delays; varies based on compliance complexity and your testing pace |

> ⚠️ **Important:** These timelines assume sequential completion of steps. Steps 2, 3, and 4 can overlap in some cases; confirm with your Ethoca Customer Delivery Team whether your organization can run MTF validation concurrently with credential generation.

*** ** * ** ***

## Next Steps {#next-steps}

* Review the [Testing](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/testing/index.md) page to prepare comprehensive test cases for MTF validation.
* Review [API Basics](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/api-basics/index.md#how-to-consume-the-api) for CSR generation instructions.
* Confirm your organization's preferred delivery model (Push, Pull, or both) with your stakeholders.
* Schedule a kickoff call with your assigned Ethoca Customer Delivery Team member to begin Step 1.

*** ** * ** ***

## FAQ {#faq}

**How do I know if my Sandbox testing is complete?**
Your Sandbox testing is complete when you have: (1) retrieved at least one alert from the Pull API, (2) acknowledged receipt, (3) submitted a valid outcome, (4) tested at least one negative scenario (for example, invalid date format, missing field), and (5) verified that your system handles errors gracefully. See [Testing](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/testing/index.md) for the full test checklist.

**Can I skip MTF validation?**
MTF validation is mandatory. It ensures your integration works correctly against production-equivalent data and configuration before live traffic begins.

**What if I only want to use Pull (or only Push)?**
You can select either Push, Pull, or both. Confirm your preference with your Ethoca Customer Delivery Team during Step 1. Your credentials and configuration will be tailored accordingly.

**Can I reuse my Sandbox credentials in Production?**
No. Sandbox and Production are separate environments with separate credential sets. Your Production credentials will be generated in Step 3.

**What if I miss the 24-hour alert response SLA?**
If you do not acknowledge or submit an outcome within 24 hours, the alert may escalate to the issuer (per chargeback handling policy). Your Ethoca Customer Delivery Team can advise on your organization's specific SLA and remediation options.

*** ** * ** ***

## Contact Support {#contact-support}

If you have questions about the onboarding process or need help at any step, see [Support](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/tutorials-and-guides/support/index.md#getting-help) for contact information.