# Readiness Preflight

Run these in order. Never print a secret: report lengths and yes or no only.

1. **Credentials are set.** The secret file exists and is excluded from git. Report `set (N characters)` or `empty` for each credential, and flag a key equal to the secret, whitespace in a value, placeholder text, or a percent sign in a fee setting.
2. **Config loads** with the project's own loader. A validation message is safe to show.
3. **Credentials work,** with one read-only call:

   | Role | Call | Expect |
   |---|---|---|
   | Partner | `get-sellers` with `payme_client_key` and `page_size: 5` | `status_code` 0 |
   | Direct seller | `get-transactions` with `seller_payme_id` and `page_size: 1` | `status_code` 0 |

   [Error 200](/agents/errors/error-200) or [error 251](/agents/errors/error-251) here usually means a value from the wrong environment.
4. **The server is running the current settings.** Compare the process start time with the settings file's modified time. The startup log should show the callback address it will send, and not `localhost` once a tunnel exists.
5. **The public address answers from the internet.** If you have no public address yet, start a tunnel with `cloudflared tunnel --url http://localhost:<port>`, following the [recipe, with Windows steps](/agents/steps/config-and-transport#a-tunnel-for-callbacks-in-development). PayMe hasn't run that recipe end to end. Call your health route through the address, such as `<public address>/health`:

   | Result | Meaning |
   |---|---|
   | 200 | Good |
   | 502 | The tunnel is up and your server is down |
   | Cloudflare error 1033 | The tunnel process has gone. A quick tunnel's address goes with it |

6. **You can call your own endpoints.** The person creates an admin credential for your app, so you never see it. For your own runs, keep a temporary one in a shell variable, never echo it, and revoke it when done.
7. **PayMe's side is confirmed:** a terminal is connected, and for partners the Default Callback URL is set. See [What to Ask PayMe First](/agents/start/ask-payme-first).

Downloading a binary or opening a public tunnel is often blocked for an agent. Give the person the recipe's exact commands, ask them to paste back only the public address, which isn't a secret, and update the settings for them.

Next: [Sandbox Walk-through](/agents/verify/sandbox-walk-through).