Skip to main content

Going Live Checklist

Use this checklist right before switching your integration from staging to production. Confirm:

  • You are using the production base URLs (api.kartapay.me, dashboard.kartapay.me) everywhere, not staging. For auth, the host is always auth.kartapay.me — make sure the URL path is /production/token, not /staging/token (see Environments).
  • Your successUrl and cancelUrl endpoints are publicly reachable over HTTPS.
  • Your webhook endpoint is publicly reachable over HTTPS and accepts HTTP POST.
  • You have implemented webhook signature verification — KartaPay does not add a security layer on your public endpoints, this is your responsibility.
  • Your webhook secret is stored securely (e.g. a secrets manager), not hard-coded.
  • You generate a unique clientId per payment so you can reconcile KartaPay payments against your own orders.
  • You have tested the full flow at least once in staging: create payment → approve on checkout → redirect to successUrl → receive webhook.

:::tip Next step Once confirmed, generate production credentials from the API Keys page of the Developer section of the production dashboard. :::