Go-live checklist

Everything to verify before switching from sandbox to production.

1. Swap sandbox keys for production

   Replace sk_test_* with your live secret key in server config only. The key never ships to the browser.

2. Register your production webhook endpoint

   Point Pulse at your live /webhooks/pulse route and store the signing secret in PULSE_WEBHOOK_SECRET. Verify a live event round-trips.

3. Confirm crediting is webhook-driven

   Credit a customer only after a verified disbursement.completed webhook. Client-side callbacks such as onSuccess are UX signals — they can be spoofed. The signed webhook is the only source of truth for crediting a user.

4. Back de-duplication with a shared store

   On multi-instance deployments, pass webhookEventStore (Redis/DB) to the Pulse constructor so redeliveries de-dupe across instances.

5. Set your Content-Security-Policy

   Allow the embed origin in frame-src (see Embed deployment & CSP).

6. Run the happy path once against production

   Create a small real session and confirm disbursement.completed credits the user.