# Onboarding

The order matters — each step depends on the one before it.

:::steps
##### Pick your integration address

An EVM address you control and won't reuse. See [the integration address](/integrations/integration-address) for how it's used and why it isn't a secret.

##### Stand up an HTTPS notification endpoint

It needs to exist before we can send you anything. HTTPS only.

##### Send us your details

The integration address, a label for our operator tooling, and the notification URL. Add a JWKS URL if you want [email attestation](/integrations/email-attestation).

##### Receive your secrets

We issue the webhook signing secret and the API secret. They are handled differently — see [the two secrets](/integrations/overview#the-two-secrets) before storing them.

##### Pass the address at SDK init

[Pass the integration address](/integrations/integration-address) when you create the SDK. Payments made before this carry no attribution.

##### Verify every signature

[Verify the HMAC](/integrations/notifications) on each notification and reject anything that fails. An unverified endpoint accepts forged payments.

##### Make your handler idempotent

Key on `chainId` + `txHash` + `version`, and discard anything not newer than what you already stored. We retry, and updates arrive out of order.

##### Sweep the Payments API

Poll the [Payments API](/integrations/payments-api) periodically. Same data, by pull — it covers anything a webhook failed to deliver.

##### Enable email attestation, if you want it

Publish your JWKS, send us the URL, and ask us to switch it on. It is off by default and a valid token does nothing until we enable it.
:::

:::warning
Before you credit anything to a user, read [a declared address is not an authenticated one](/integrations/integration-address#a-declared-address-is-not-an-authenticated-one). A notification means a payment *claimed* your integration address — not that it came from your app. Reconcile against your own records.
:::