# Go-live checklist

What to check before your integration takes real payments, covering approval and a live key, the key's expiry date, https redirects, trusted origins, a subscribed and verified webhook endpoint, branching on livemode, mobile app registration and a small live test.

Source: https://vezmo.com/docs/developers/go-live

## Overview

Going live means swapping your test key for a live key: the base URL, the calls and the webhook endpoint stay the same.
Before you swap, go through this list. Each item links to the page that explains it.

**Developers** keeps a short version at the top: **Connect your site or app**, with four steps that tick themselves off.

(Screenshot: Connect your site or app, 2 of 4 done: Generate a test key (done), Add a webhook endpoint (done), Add your website (lets the embedded checkout load there) and Go live (generate a live key for real payments), with an API reference button.)

## The checklist

### 1. VezmoPay is approved, and you have a live key

Live keys open once VezmoPay is approved for your business. Then, in **Developers › API keys**, select
**Generate live key** in the **Live keys** card and confirm with the emailed code. Store the key and the secret on
your production server only. See [API keys and access tokens](/docs/developers/api-keys).

Generate it as a teammate who will stay: a key stops working when the teammate who made it leaves the team.

### 2. You know the key's expiry date

The key's row shows its expiry date, or **No expiry**. A key stops working at the end of that day, and every call with it
then fails with `401`. We email you 30 and 7 days before; to move or remove the date, use **Change expiry** on the key's
row. See [The expiry date](/docs/developers/api-keys#the-expiry-date).

### 3. Your server uses the live key

Swap the key and the secret in your production settings. Sign in once and reuse the access token for 30 minutes; never
sign in once per call. If you use your order numbers as `Idempotency-Key`s, make sure your test runs used other ones:
see [Hosted checkout](/docs/developers/hosted-checkout#your-order-number).

### 4. Your redirect addresses are your real pages

`successUrl` and `cancelUrl` must be `https://` addresses on your live site. Your success page shows the order's status,
but doesn't ship it: the webhook does.

### 5. Your website is a trusted origin (embedded checkout and card fields)

The embedded checkout and the card fields work only on the sites listed in **Developers › Trusted origins**. Add each
live origin, like `https://yourstore.com`: the scheme and the domain only, no path. The hosted checkout and payment links
don't need this. See [Embedded checkout and card fields](/docs/developers/embedded-checkout).

(Screenshot: Developers, Trusted origins tab: Trusted origins, 0 of 20, the websites allowed to load your embedded checkout, a field with the placeholder https://yourstore.com and an Add origin button, the hint Scheme and domain only, and No origins yet.)

### 6. Your webhook endpoint is subscribed and checks signatures

In **Developers › Webhooks**, your production endpoint:

- is **Enabled** and ticks every event your code handles: at least `payment.success` and `payment.failed`, plus
  `payment.processing` if you take bank payments, and `dispute.created` and `payment.refunded` if you act on those;
- checks `X-Webhook-Signature-V2` and refuses an old timestamp;
- answers `2xx` within 5 seconds and skips an event `id` it has already handled.

See [Webhooks](/docs/developers/webhooks).

### 7. Your code checks `livemode`

Test and live events reach the same endpoint. Ship an order only when `data.livemode` is `true`, and the amount and
currency match the order.

### 8. Your app is registered (mobile apps only)

If customers pay in your iPhone or Android app, add each app and its return link under **Developers › Mobile apps**. A
checkout sends the customer back only to a return link listed there. To offer Apple Pay inside an iPhone app, add the
Apple Pay certificate in the same tab. See [Mobile apps in the API reference](https://user.vezmo.com/docs/v1/mobile).

### 9. A small live payment works

Make one real payment with your own card, through your live integration:

1. It shows in **VezmoPay › Transactions** with Test mode off.
2. Your endpoint received `payment.success` with `livemode: true`, and your order was marked paid.
3. `GET /merchant/payment/:id` with the live key reads `"state": "succeeded"`.

You can then refund it from its details page: see [Refund a payment](/docs/get-paid/payment-details#refund-a-payment).
What a payment and a refund cost is on [VezmoPay pricing](https://vezmo.com/pricing/vezmopay).

## After you go live

- Watch **Developers › Webhooks › Deliveries** for failed deliveries in your first days.
- Keep your test key: build and test changes in the sandbox before they reach live.
- If an API secret leaks, revoke the key or generate a new one at once. If a webhook signing secret leaks, replace the
  endpoint ([Change the signing secret](/docs/developers/webhooks#change-the-signing-secret)).

## Related

- [API keys and access tokens](/docs/developers/api-keys)
- [Test mode for developers](/docs/developers/test-mode)
- [Webhooks](/docs/developers/webhooks)
- [Choose how to take payments](/docs/developers/integration-options)