# Going live

When your integration works end to end in [test mode](/guides/testing/), follow this
checklist to go live.

## Checklist

- **Swap your key.** Replace `sk_test_…` with your `sk_live_…` key. The base URL doesn't
  change: the key selects the mode. Live keys are available once your business
  verification is approved, and are shown only once — store yours in a secrets manager.
- **Configure your live webhook endpoint and secret.** Live mode has its own endpoint and
  its own `whsec_…` secret: set them in your dashboard in live mode, and confirm
  signature verification passes on a real event.
- **Verify every webhook** — accept any matching `v1` signature, within 5 minutes of the
  timestamp. See [Verify the signature](/guides/webhooks/#verify-the-signature).
- **Fulfil from webhooks, not redirects.** Orders are marked paid by `session.succeeded`;
  `return_url` is UX only.
- **Deduplicate** on `X-Paymee-Webhook-Id`, make your handler idempotent, and don't depend
  on the order events arrive in.
- **Return `2xx` within 10 seconds** from your webhook endpoint; do heavy work
  asynchronously.
- **Retry safely.** Reuse the same `merchant_reference` when retrying a session creation,
  and send an `Idempotency-Key` with every refund. See [Idempotency](/guides/idempotency/).
- **Send amounts as strings** with exactly three decimals for TND. See
  [Amounts & currency](/guides/amounts-and-currency/).
- **Handle errors by `type`.** Retry only `429` and `500`, with backoff. See
  [Errors](/guides/errors/).
- **Secure your secrets.** Keep `sk_…` and `whsec_…` server-side, out of source control
  and logs. Rotate them from the dashboard if exposed.

## Production endpoints

| Purpose | URL |
| --- | --- |
| API base | `https://api.paymee.online/api/v1` |
| Create session | `POST /gateway/sessions/` |
| Webhooks (you receive) | your configured `webhook_url` |

Once live, reconcile regularly: fetch [sessions](/guides/hosted-checkout/#retrieving-sessions)
(each with its `refunds`) and check your
[webhook delivery history](/reference/operations/listwebhookdeliveries/) for events your
endpoint missed.

Source: https://docs.paymee.online/guides/going-live/