Hashpayhashpaydocs
Get started

Go Live (Production Checklist)

Final preparation and launch verification checklist before transitioning your Hashpay integration to live mainnet transactions.

Production configuration switch

  1. Switch Base API URL — Point your backend API client from https://api.hashpay.id/v2/testnet to https://api.hashpay.id/v2/mainnet.
  2. Install Production Secret Keys — Replace testnet API credentials with your live production api-key and merchant_id obtained from your verified merchant dashboard.
  3. Configure Production Webhook Endpoint — Enter your public, secure HTTPS webhook endpoint (e.g., https://mystore.com/api/hashpay-webhook) in Settings → API Keys & Webhooks.
  4. Verify Checkout Hosted Domain — Ensure your checkout redirect target resolves to https://webview.hashpay.id/ (without the /sandbox route prefix).
  5. Bind Settlement Bank Account or Crypto Wallet — Verify your bank details or cold wallet address in Settings → Settlement so your sales revenue sweeps correctly.

Pre-launch security checklist

  • Secret Key is stored strictly in server environment variables / secret manager; never exposed in public client bundles or Git repositories.
  • Incoming webhook signatures are cryptographically validated against X-Hashpay-Signature using your live Webhook Signing Secret.
  • Webhook event handler is idempotent and rejects duplicate delivery using X-Hashpay-Idempotency-Key or order_no tracking.
  • Webhook replay prevention is active: requests with X-Hashpay-Timestamp older than 300 seconds are rejected.
  • Webhook endpoint returns HTTP 200 or 204 within 3 seconds, queuing background fulfillment tasks asynchronously.
  • Reconciliation cron worker is active to poll POST /merchant/fiat/getOrder as an automated fallback for unhandled orders.