guides

Going live

What changes between the sandbox and live processing, and what apay needs from you.

Sandbox versus live

	Sandbox	Live
Keys	`snd_…`, `pk_snd_…`	`prd_…`, `pk_prd_…` (issued at go-live)
Processors	Test processors and processor test accounts	Your live processor or partner bank contract
Card data	Test cards only, mock vault	Real cards, PCI-compliant vault
Settlement	None	To your bank account by the processor or partner bank, per their schedule
Support	Email	Email plus named contact for platform accounts

Processor or partner bank contract. Either bring your own processor account (Stripe, Adyen, Checkout.com, Airwallex and others) or use an apay partner in your market. Onboarding with the partner includes KYC/KYB, a merchant category, expected volumes and a settlement account.
Live credentials. Add the processor’s live credentials in the dashboard under the live profile. apay verifies them with a zero-amount authorisation.
Wallets. Register your domains for Apple Pay and set the Google Pay merchant ID, see Wallets.
Webhooks. Point the live webhook URL at your production endpoint and verify signatures with the live hash key.
Return URLs. Set production return URLs on the profile and in your confirmParams.
3-D Secure policy. Decide authentication_type per market (three_ds recommended in Europe, India and where liability shift matters).
Test in live. Run a real small payment and refund it.
Monitoring. Enable alerts on success rate and webhook failures in the dashboard.

Using the checkout SDK keeps your integration at PCI DSS SAQ A. Sending card data to your own servers requires SAQ D or higher.
Card scheme rules, refund windows and dispute processes are those of the processor or partner bank named in your agreement.