Going live

Test end to end in the sandbox, then run the checklist before flipping to live keys.

Before real money moves, prove the whole flow in a mock environment, then walk the checklist. Crypto settlement is final — there are no chargebacks — so anything you'd normally catch "in dispute" you must catch before cutover.

Test without real funds

Two ways to test, both mock-backed and both fire the same webhooks as production:

	Test mode on production	Dedicated sandbox
Host	`api.absolutepay.io`	`sandbox-api.absolutepay.io`
Key	`ap_test_…`	`ap_test_…` (sandbox app)
App approval	requires admin review	auto-approved
Settlement	mock	mock (you can trigger it)

Use the dedicated sandbox (sandbox.absolutepay.io) while building — apps are auto-approved so there's no review wait. Point the SDK at it with sandbox: true (Node), sandbox=True (Python), or absolutepay.WithSandbox(true) (Go).

Test the full loop

Create a checkout → in the sandbox it auto-settles shortly after.
Expose a local webhook receiver with a tunnel (ngrok http 4455) and set that URL on your sandbox app.
Confirm the payment.succeeded webhook arrives and verifies on the raw body (Webhooks).
Create a payout with an Idempotency-Key; retry the same call and confirm it doesn't double-pay.
Pull reconciliation and match against your own records.
Force failures (bad amount, unsupported chain, missing scope) and confirm your error handling (Errors).

Approval — configure the live app before it's reviewed

A live app needs a verified workspace (KYC/KYB in the dashboard) and must be approved by review before it can authenticate or receive webhooks.

Editing a live app re-triggers review

Editing any app detail — name, homepage, webhook URL, IP allowlist — resubmits the app for review, and it can't authenticate until re-approved. So set the production webhook URL and IP allowlist in one edit, before approval — don't plan to "flip the URL later" on a live app. Rotating the app's token does not trigger re-review.

Go-live checklist

Account & compliance

Workspace KYC/KYB verified; live app approved (out of pending review).
If your compliance requires blocking specific countries from your checkout, enforce the geoblock at your edge/CDN — a payment accepted from a blocked region can't be reversed.

Code

Secrets (apiKey, signingSecret, webhookSecret) loaded from env — never hard-coded or in a browser.
Requests signed (or using the SDK, which signs for you) — see Authentication.
Webhook receiver deployed, verifying signatures on the raw body, idempotent on event.id.
Idempotency-Key on every money-moving write; balance checked before payouts.
Amounts handled as decimal strings end to end — no floats anywhere on the money path.
Errors handled with exponential backoff on 429/5xx (Errors).

Configuration

Production webhook URL set on the live app (before approval — see above); whsec_ secret stored securely.
Per-app IP allowlist (CIDRs) configured if you restrict where API calls originate.

Operations & monitoring

Error logging captures code + x-request-id (quote both in support tickets).
Webhook delivery monitored (Developers → Apps → Deliveries) with an alert on failed deliveries.
Reconciliation job scheduled (hourly/daily) and diffing against your own ledger.
Alerting on error-rate spikes and on payouts stuck out of a terminal state.

Cut over

Swap the ap_test_ app for the approved ap_live_ one and update your env vars — same base URL, same request shapes, only the credentials change. Then smoke-test the live credentials with a read-only call before sending traffic:

const balances = await ap.balances.list(); // proves key, signature, and scope
console.log(balances);

balances = ap.balances.list()  # proves key, signature, and scope
print(balances)

balances, err := ap.Balances.List(ctx) // proves key, signature, and scope
if err != nil {
	log.Fatal(err)
}
fmt.Println(balances)

curl https://api.absolutepay.io/v1/balances \
  -H "Authorization: Bearer $APP_TOKEN" $(sign GET /v1/balances "")

A 401/403 here means a key, signature, or scope problem — fix it before any money moves (Errors). Watch the first 24h closely: error rates, webhook delivery, and the first scheduled reconciliation run.

Authentication — keys, scopes, and request signing.
Webhooks — verification and idempotent handling, end to end.
Balances & reconciliation — the settled ledger your job should diff.
Errors and the API reference — retry strategy and every endpoint.

Errors & idempotency

The error shape, handling errors in the SDK, idempotency, rate limits, and retrying safely.

API Reference