Production checklist

List of recommended steps to complete before launching the product to the user.

The steps below are a list of recommendations that Cas should take before deploying Cas integration in the Production environment. A few steps may not be important, but completing the following steps will help ensure that the integration of Cas into your product is stable, secure and easy to maintain.

Production setup

Already have an account on https://console.bankhub.dev

Make sure you're using the secret information of the production, the secret key information you can view on https://console.bankhub.dev

Configure for Cas Link and server code using information from the production environment, by changing the value of the API keys when sending a request to Cas.

Add teammates to the Console to give other users access, details Cas teams

Cas Link setup

Make sure your OAuth integration works

To avoid unnecessary charges and confusion for users, implement a duplicate grant avoidance logic.

Ensure the scopes prarameter of POST /grant/token includes only the scopes you intend to use.

Webhook Configuration

Cas uses webhook for more common flow. For your application to work smoothly with Cas integration, the webhook needs to be set up.

Make sure you can receive webhooks from Cas webhook IPs

Preview Cas webhook to ensure that your webhook processing logic is accurate when the system is unstable or traffic increases/

Error handling

Sometimes, Cas API calls may fail due to system interruptions or connection errors to financial institutions. Implement retry logic or error handling as necessary for product API calls.

Update mode

Update mode is used to update changes to authorized accounts (e.g. users change account passwords).

Handel the GRANT_LOGIN_REQUIRED Grant error states by launching Update Mode to ensure your users retain access to their Grants. For more information, see Update mode

Grant management

Delete Grants using /grant/remove when those decentralizations are no longer in use. For example, you allow users to delete financial account links through your application interface.

Handling cases that require OTP verification for deletion and suspension of permissions

Store & logging

Properly logged to enhance troubleshooting and security when contacting support on a request or callback, as well as searching in Logs.

Access Tokens and Grant IDs are the core identifiers map to a customer's financial account. Save them in a secure place and associate accounts with users on your app. Make sure this information does not appear in the application interface. And a user can create multiple grants if the user has multiple financial accounts.

Definitely stored the identifiers below in a secure, as they will be necessary when contacting support for details of a request or callback.

requestId: Included in all Cas API responses.

grantId: Included in all successful Cas API responses that relate to a specific Grant.

All products

Handle the USER_PERMISSION_REVOKED from Grant's webhook when a grant or financial account is deleted on Cas Mobile.

Handle the DEFAULT_UPDATE from Grant's webhook, the value sent when the financial account associated with Grant is reconnected.