Going live

When your integration works end to end in test mode, follow this checklist to go live.

Checklist

Swap your key. Replace sk_test_… with your sk_live_… key. The base URL doesn’t change: the key selects the mode. Live keys are available once your business verification is approved, and are shown only once — store yours in a secrets manager.
Configure your live webhook endpoint and secret. Live mode has its own endpoint and its own whsec_… secret: set them in your dashboard in live mode, and confirm signature verification passes on a real event.
Verify every webhook — accept any matching v1 signature, within 5 minutes of the timestamp. See Verify the signature.
Fulfil from webhooks, not redirects. Orders are marked paid by session.succeeded; return_url is UX only.
Deduplicate on X-Paymee-Webhook-Id, make your handler idempotent, and don’t depend on the order events arrive in.
Return 2xx within 10 seconds from your webhook endpoint; do heavy work asynchronously.
Retry safely. Reuse the same merchant_reference when retrying a session creation, and send an Idempotency-Key with every refund. See Idempotency.
Send amounts as strings with exactly three decimals for TND. See Amounts & currency.
Handle errors by type. Retry only 429 and 500, with backoff. See Errors.
Secure your secrets. Keep sk_… and whsec_… server-side, out of source control and logs. Rotate them from the dashboard if exposed.

Once live, reconcile regularly: fetch sessions (each with its refunds) and check your webhook delivery history for events your endpoint missed.