Skip to main content

Review and test your integration

Review and test every generated or modified file before you use the integration in production.

If you use an early access capability, complete additional testing and validation before you rely on it. Tokenization, standalone 3-D Secure, Account Updater, and jpm-notifications are currently identified as early access.

Review the implementation

Confirm that: 

  1. You reviewed every created or modified file.
  2. Request fields, headers, URLs, and environment variables match the current Payments Developer Portal documentation.
  3. All generated files appear in the intended locations.
  4. The implementation contains only the changes you expect.
  5. Error handling meets your application’s requirements.
  6. The integration reuses the generated authentication module instead of requesting a new access token unnecessarily.

If you used jpm-csr, review the generated Certificate Signing Request and private key before you provide the CSR to your J.P. Morgan Relationship Manager. Keep the private key secure and don’t share it. The skill is a standalone onboarding helper that generates a CSR and private key for client ID provisioning.

If you used jpm-notifications, confirm that your implementation verifies inbound webhook events and handles duplicate events appropriately. If your configuration uses mTLS, verify that configuration as well. The skill covers signature verification, optional mutual TLS, and duplicate event handling.

Protect credentials and environments

Confirm that:

  1. Credentials, certificates, private keys, access tokens, and production secrets remain outside source control.
  2. Your .env file isn’t committed to the repository.
  3. Client Acceptance Testing and production values remain separate.
  4. Your application uses the correct API URL, credentials, and configuration for the target environment.
  5. Client Acceptance Testing values don’t appear in the production configuration.
  6. Production values don’t appear in the Client Acceptance Testing configuration.

Test the integration

Test the integration in the Client Acceptance Testing environment before you configure it for production.

Confirm that:

  1. Your application can obtain an access token when authentication applies to the selected skill.
  2. Your application reuses the access token until shortly before it expires.
  3. API requests contain the required headers and fields.
  4. Your application handles successful and unsuccessful API responses appropriately.
  5. The selected Commerce API integration or capability works as expected.
  6. The integration uses the correct configuration for the target environment.
  7. Early access capabilities have completed the additional testing and validation required for your use case.

For Account Updater card registration workflows, include the applicable webhook notification behavior in your tests when you use jpm-notifications. The repository describes Account Updater as supporting inquiry mode or card registration mode, with the asynchronous card registration workflow using jpm-notifications.

Complete your required reviews

Before you move to production:

  1. Complete your organization’s security review.
  2. Complete your organization’s compliance review.
  3. Complete the required testing and code review processes.
  4. Verify the final implementation against the current Payments Developer Portal documentation.
  5. Obtain all required approvals.
Attention

Review generated code

Generated code can contain functional, security, or compliance issues. A qualified engineer must review and verify it before you use it in production.

Important limitations

The skills provide reference implementations and guided development support. They don’t:

  1. Complete J.P. Morgan onboarding or issue credentials.
  2. Support every J.P. Morgan Payments API.
  3. Guarantee that generated code is correct or ready for production.
  4. Replace Payments Developer Portal documentation.
  5. Replace your required engineering, security, compliance, testing, or code review processes.

The current Commerce coverage includes Checkout, Online Payments, Tokenization, standalone 3-D Secure, and Account Updater. Reporting and other APIs are planned for future releases, but the source doesn’t provide release dates.

If you encounter a problem

Review the troubleshooting guidance for common installation, authentication, credential, and integration issues. For more, see Troubleshooting.

You can also review the current source instructions, supported capabilities, and early access status in GitHub.