Going live
Production is a controlled change, not a key swap. Go live only after a complete sandbox workflow—including webhook verification and recovery testing—works end to end.
Production readiness gate
- A complete sandbox flow works: request, final webhook, and reconciliation.
- API keys are server-side and excluded from repositories and logs.
- Webhook signatures, timestamp checks, and event-ID deduplication are implemented.
- Write requests use a unique
ref, and timeout recovery keeps the original reference. - Your team can inspect transaction and webhook logs and has an escalation path.
Make the environment cutover
| Setting | Sandbox | Production |
|---|---|---|
| Base URL | https://sandbox.payscribe.ng/api/v1 | https://api.payscribe.ng/api/v1 |
| API key | ps_pk_test_... | ps_pk_live_... |
| Webhook endpoint | Test HTTPS endpoint | Stable production HTTPS endpoint |
Deploy production configuration through your secret manager or hosting environment. Never make the replacement in client-side code or commit a live key to a configuration file.
Configure production webhooks
Create a production webhook in Settings → Webhooks and use its production webhook secret. Confirm that the endpoint is HTTPS, signature verification uses the raw body, and duplicate event IDs are harmless.
Run a controlled launch
- Deploy the production configuration.
- Make one small, approved production operation appropriate to your product.
- Confirm the API result, the corresponding webhook, and the final dashboard/ledger state.
- Check that your customer-facing state matches the reconciled result.
- Monitor closely before increasing volume.
If the outcome is uncertain after a write timeout, do not create a new ref. Reconcile the original operation first.
Monitor and recover
Monitor failed API requests, webhook verification failures, duplicate-event handling, and reconciliation mismatches. Keep safe correlation values such as request ref, transaction ID, and webhook event ID in your logs; never log credentials or authorization headers.
If a production issue is detected, pause the affected workflow, preserve the original references, reconcile state, and contact support with safe correlation values.
Continue operating
Use Sandbox testing for every significant release, Webhooks for delivery security, and API lifecycle for compatibility expectations.
Was this page helpful?