> ## Documentation Index
> Fetch the complete documentation index at: https://docs.laces.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Going live

> The launch checklist for your integration: verify it end to end, tidy your keys and domains, and switch your site on.

There is no separate test environment to switch away from: you have been
building against production all along (see
[Testing your integration](/concepts/testing)). Going live is about making
sure the integration is solid and that nothing from development is left
behind.

## Before launch

<Steps>
  <Step title="Your integration passes end to end">
    * [ ] A token is minted from your **server** and cached for its hour.
    * [ ] Events list and render, with fees shown exactly as returned.
    * [ ] Hosted or embedded checkout completes on your production origin, and
      your server verifies the session (`status: "complete"`) before
      fulfilling.
    * [ ] Custom UI: an order is created, paid to your own number, and reaches
      `paid`.
    * [ ] Your webhook receiver verifies the signature on the **raw body**,
      dedupes on `X-Laces-Delivery`, and answers `2xx` within 10 seconds.
    * [ ] **Send test event** in the app gets a `2xx` from your production
      receiver, and a real test order produced `order.paid`.
  </Step>

  <Step title="Error handling is in place">
    * [ ] You branch on `error_code`, never on the `error` text, and you log
      `X-Request-Id` with every error.
    * [ ] Retries reuse the same `Idempotency-Key`.
    * [ ] `429` honours `Retry-After`.
    * [ ] `payments_enabled: false` shows "registration not open" instead of a
      buy button.
    * [ ] `prompt_in_progress` waits; it is not treated as a failure.
  </Step>

  <Step title="Secrets are where they belong">
    * [ ] The client secret and webhook signing secret are in your secret
      manager or server environment, not in source control, not in a browser
      bundle, not in a mobile app.
    * [ ] Only the publishable key appears in page source.
    * [ ] Your base URL is `https://connect.laces.run/v1` everywhere.
  </Step>
</Steps>

## Tidy up

<Steps>
  <Step title="Use a key for production only">
    Ideally your production site has its own API key, separate from the one you
    developed with. If you developed with this key, consider
    [Regenerate keys](/api-keys#regenerate-keys) so any copy of the secret on a
    laptop stops working after 24 hours.
  </Step>

  <Step title="Remove local domains">
    Remove every `http://localhost:<port>` and `http://127.0.0.1:<port>` entry
    from the production key's **Allowed domains** and **Return URL domains**.
    The app marks a key that still has one with "Local development domain:
    remove before launch". Make sure your production origins are listed, and
    list both `https://example.com` and `https://www.example.com` if you
    serve both.
  </Step>

  <Step title="Point webhooks at production">
    In **Settings → Developers → Webhooks**, make sure the endpoint URL is your
    production receiver, not a tunnel, and that the server holds its current
    signing secret. Delete endpoints you only used for development.
  </Step>

  <Step title="Retire the test event">
    Close, end or delete the unlisted test event, and refund any paid test
    orders from the Laces app. The Partner API lists unlisted events, so a
    forgotten test event can appear on your site.
  </Step>

  <Step title="Launch and watch">
    Switch your site's Register buttons on. Make one small real purchase end
    to end, confirm the `order.paid` webhook arrives, and refund it if you
    need to.
  </Step>
</Steps>

## After launch

* Use one API key per site, so you can revoke one without affecting the
  others. An organization can hold up to 10 active keys.
* Regenerate keys periodically. The old secret keeps working for
  [24 hours](/api-keys#regenerate-keys), but the old publishable key stops
  immediately, so update your pages straight away.
* Watch for webhook failures. After 50 consecutive failed attempts Laces
  disables the endpoint; re-enable it in the app once your receiver is fixed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.