Go live

Moving to live traffic is a reviewed step. Contact your account manager with your integration ready.

Checklist

• You use the live baseUrl, merchantIdentifier, API key and MID, none of the test ones
• The API key lives in a secret store and is only used server-side
• Card numbers and security codes are never logged or stored
• Every order has a unique referenceCode
• Your postback URL is public https, answers 2xx quickly and confirms status with a lookup
• You handle DECLINED, ERROR, IN PROGRESS and network timeouts
• If you use the widget, your live site origin is on the gateway’s allowed origins and a session is opened per order from your server
• You never mark an order paid from the browser callback alone; the postback or a lookup decides
• You handle 429 with a growing pause, not a tight retry loop
• You tested refunds on a processor that supports them
• You confirmed your PCI obligations with your account manager

After launch

Watch declines and ERROR rates, keep a runbook for rotating the API key, and subscribe to the changelog.