[{"data":1,"prerenderedAt":111},["ShallowReactive",2],{"content-\u002Fprompts\u002Fintegration-quality-audit":3,"prompts-category-diagnostics":101},{"id":4,"title":5,"author":6,"body":7,"categories":6,"category":83,"categoryType":6,"date":84,"description":85,"extension":86,"faq":6,"howto":6,"isBlog":87,"isChangelog":87,"meta":88,"navigation":89,"path":90,"pillar":87,"products":91,"rawbody":97,"seo":98,"stem":99,"thumbnail":6,"updated":6,"__hash__":100},"content\u002Fprompts\u002Fintegration-quality-audit.md","Integration quality audit",null,{"type":8,"value":9,"toc":77},"minimark",[10,14,19,30,34,47,51],[11,12,13],"p",{},"Paste this prompt into your coding agent to grade an existing integration against how the API is meant to be used.",[15,16,18],"h2",{"id":17},"prompt","Prompt",[20,21,27],"pre",{"className":22,"code":24,"language":25,"meta":26},[23],"language-text","Audit my existing BlindPay integration for correctness, security, and resilience. Read the code, then produce a findings report; do not change code until I approve the findings.\n\nGround truth for the audit:\n- https:\u002F\u002Fblindpay.com\u002Fdocs\u002Fllms.txt (read the pages relevant to the flows you find in my code)\n- The OpenAPI spec: curl https:\u002F\u002Fapi.blindpay.com\u002Fdoc\n\nAudit checklist:\n1. API key handling: keys only on the server, never in client bundles, logs, or version control; scoped per instance.\n2. Quote lifecycle: every quote executed before its expires_at is read from the response (not hardcoded); a re-quote path exists for expiry failures; quotes are never reused across payment attempts; currency_type is used with the correct convention on payins (sender = fiat) versus payouts (sender = stablecoin).\n3. Amounts: integer minor units everywhere, no floating point money math anywhere in the pipeline.\n4. Webhook security: Svix signature verification over the raw body with constant-time comparison and timestamp tolerance; svix-id dedup; fast 2xx responses with async processing; no state driven by polling where a webhook event exists.\n5. Idempotency and double-send protection: payouts and payins are keyed on my own payment IDs so a retry or crash cannot create a duplicate transfer; the ToS call uses a proper UUID idempotency_key.\n6. Error and failure paths: rejected KYC (including compliance_request RFIs), failed and refunded payouts, expired quotes, and unsupported-country errors all have explicit handling, not just the happy path.\n7. State and reconciliation: BlindPay IDs (re_, ba_, bw_, bl_, va_, qu_, po_, pi_, tr_) persisted against my records; a reconciliation job or report compares my ledger with BlindPay statuses.\n8. Environment hygiene: no sentinel test amounts ($666.00\u002F$777.00), USDB token, or testnet networks reachable from production configuration; webhook endpoints configured separately per instance.\n\nFor each finding report: severity (critical, high, medium, low), the file and line, what is wrong, the concrete failure it can cause, and the fix. Order by severity. Finish with the three fixes I should make first.\n","text","",[28,29,24],"code",{"__ignoreMap":26},[15,31,33],{"id":32},"how-to-use","How to use",[35,36,37,41,44],"ol",{},[38,39,40],"li",{},"Paste the prompt and point the agent at the code paths that touch BlindPay.",[38,42,43],{},"Review the findings report before letting it fix anything.",[38,45,46],{},"Re-run the audit after fixes; it should come back clean.",[15,48,50],{"id":49},"related-docs","Related docs",[52,53,54,63,70],"ul",{},[38,55,56],{},[57,58,62],"a",{"href":59,"rel":60},"https:\u002F\u002Fblindpay.com\u002Fdocs\u002Fintroduction",[61],"nofollow","Introduction",[38,64,65],{},[57,66,69],{"href":67,"rel":68},"https:\u002F\u002Fblindpay.com\u002Fdocs\u002Flearn\u002Fwebhooks-verification",[61],"Signature verification",[38,71,72],{},[57,73,76],{"href":74,"rel":75},"https:\u002F\u002Fblindpay.com\u002Fdocs\u002Flearn\u002Fsandbox-vs-production",[61],"Sandbox vs production",{"title":26,"searchDepth":78,"depth":78,"links":79},2,[80,81,82],{"id":17,"depth":78,"text":18},{"id":32,"depth":78,"text":33},{"id":49,"depth":78,"text":50},"diagnostics","2026-08-26","Audit an existing BlindPay integration for correctness and resilience: quote expiry handling, webhook security, idempotency, error paths, and reconciliation.","md",false,{},true,"\u002Fprompts\u002Fintegration-quality-audit",[92,93,94,95,96],"payouts","payins","webhooks","quotes","compliance","---\ntitle: \"Integration quality audit\"\ndescription: \"Audit an existing BlindPay integration for correctness and resilience: quote expiry handling, webhook security, idempotency, error paths, and reconciliation.\"\ndate: \"2026-08-26\"\ncategory: \"diagnostics\"\nproducts: [\"payouts\", \"payins\", \"webhooks\", \"quotes\", \"compliance\"]\n---\n\nPaste this prompt into your coding agent to grade an existing integration against how the API is meant to be used.\n\n## Prompt\n\n```text\nAudit my existing BlindPay integration for correctness, security, and resilience. Read the code, then produce a findings report; do not change code until I approve the findings.\n\nGround truth for the audit:\n- https:\u002F\u002Fblindpay.com\u002Fdocs\u002Fllms.txt (read the pages relevant to the flows you find in my code)\n- The OpenAPI spec: curl https:\u002F\u002Fapi.blindpay.com\u002Fdoc\n\nAudit checklist:\n1. API key handling: keys only on the server, never in client bundles, logs, or version control; scoped per instance.\n2. Quote lifecycle: every quote executed before its expires_at is read from the response (not hardcoded); a re-quote path exists for expiry failures; quotes are never reused across payment attempts; currency_type is used with the correct convention on payins (sender = fiat) versus payouts (sender = stablecoin).\n3. Amounts: integer minor units everywhere, no floating point money math anywhere in the pipeline.\n4. Webhook security: Svix signature verification over the raw body with constant-time comparison and timestamp tolerance; svix-id dedup; fast 2xx responses with async processing; no state driven by polling where a webhook event exists.\n5. Idempotency and double-send protection: payouts and payins are keyed on my own payment IDs so a retry or crash cannot create a duplicate transfer; the ToS call uses a proper UUID idempotency_key.\n6. Error and failure paths: rejected KYC (including compliance_request RFIs), failed and refunded payouts, expired quotes, and unsupported-country errors all have explicit handling, not just the happy path.\n7. State and reconciliation: BlindPay IDs (re_, ba_, bw_, bl_, va_, qu_, po_, pi_, tr_) persisted against my records; a reconciliation job or report compares my ledger with BlindPay statuses.\n8. Environment hygiene: no sentinel test amounts ($666.00\u002F$777.00), USDB token, or testnet networks reachable from production configuration; webhook endpoints configured separately per instance.\n\nFor each finding report: severity (critical, high, medium, low), the file and line, what is wrong, the concrete failure it can cause, and the fix. Order by severity. Finish with the three fixes I should make first.\n```\n\n## How to use\n\n1. Paste the prompt and point the agent at the code paths that touch BlindPay.\n2. Review the findings report before letting it fix anything.\n3. Re-run the audit after fixes; it should come back clean.\n\n## Related docs\n\n- [Introduction](https:\u002F\u002Fblindpay.com\u002Fdocs\u002Fintroduction)\n- [Signature verification](https:\u002F\u002Fblindpay.com\u002Fdocs\u002Flearn\u002Fwebhooks-verification)\n- [Sandbox vs production](https:\u002F\u002Fblindpay.com\u002Fdocs\u002Flearn\u002Fsandbox-vs-production)\n",{"title":5,"description":85},"prompts\u002Fintegration-quality-audit","0fApvDtVwrt7qbxJaMahI9AcNBSbbD_sYH2t8cSL9Wc",[102,106,107],{"path":103,"title":104,"description":105},"\u002Fprompts\u002Fbuild-reconciliation-ledger","Build a reconciliation ledger","A daily job that compares your database against BlindPay's payout, payin, and transfer statuses, catches drift, and alerts on stuck or mismatched money.",{"path":90,"title":5,"description":85},{"path":108,"title":109,"description":110},"\u002Fprompts\u002Fproduction-readiness-checklist","Production readiness checklist","Verify a BlindPay integration is ready to move from a development instance to production: config, tokens, networks, webhooks, compliance, and monitoring.",1787868851156]