Going live

When your integration works end-to-end in the sandbox, follow this checklist to go live.

Checklist

• Swap your keys. Replace sk_test_… with your sk_live_… key and point at the production base URL https://api.paymee.online/api/v1.
• Use the live webhook secret. Configure your endpoint with the production whsec_… secret and confirm signature verification passes on a real event.
• Verify every webhook. Reject any webhook whose X-Paymee-Signature does not validate. Never trust an unverified payload.
• Fulfil from webhooks, not redirects. Confirm orders are marked paid by the session.succeeded webhook, and that return_url is treated as UX only.
• Deduplicate on X-Paymee-Webhook-Id and make your handler idempotent.
• Reuse merchant_reference per order so retries don’t double-charge. See Idempotency.
• Format amounts per currency. TND uses three decimals — see Amounts & currency.
• Handle errors by type. Branch on the RFC 9457 type, retry only 429, 500, and 502 with backoff. See Errors.
• Return 2xx fast from your webhook endpoint; do heavy work async.
• Secure your secrets. Keep sk_… and whsec_… server-side, out of source control and logs. Rotate from the dashboard if exposed.

Production endpoints

Purpose	URL
API base	https://api.paymee.online/api/v1
Create session	POST /gateway/sessions/
Webhooks (you receive)	your configured webhook_url

Once live, monitor webhook delivery history and reconcile against session status for any payments where a webhook was missed.