Go-live checklist

Test and live are fully separated — keys, webhooks, and chains. Going live is five deliberate switches, not a redeploy.

The checklist#

1. Verify your payout wallet

   The payout wallet on your live project must be verified by signing with that wallet. Once verified, it can only be rotated through the same signed flow — a stolen dashboard login alone cannot redirect your money.

2. Create a live API key

   Generate a dp_live_… key in the dashboard. Live keys are shown once — store the key in your secret manager immediately. (Test keys stay re-viewable, by design.)

3. Switch your chain ID to mainnet

   Live keys refuse testnet chains, so this is enforced, not just recommended. On Polygon mainnet the default token is USDT. See Chains & tokens for what’s live.

   the only code changeCopy

   const charge = await duckypay.charges.create({
   -  chainId: 80002,        // Polygon Amoy testnet
   +  chainId: 137,          // Polygon mainnet
      fiat: { currency: 'USD', amount: '25' },
      paymentMode: 'both',
      reference: order.id,
   });

4. Register a live webhook endpoint

   Webhook endpoints are mode-scoped: testnet invoices deliver only to test endpoints, mainnet invoices only to live ones. Register your production URL as a live endpoint and verify signatures with its own secret — see Webhooks.

5. Make one small real payment

   Before announcing anything, run one real charge end-to-end: create → pay → receive the invoice.paid webhook → confirm the funds arrived in your payout wallet on a block explorer. That last step is the whole point of non-custodial: you can independently verify every payment.

Test vs live are separate worlds#

Security notes#

• Keep API keys server-side. Never ship a key in frontend code — the browser only ever needs the checkoutUrl / invoiceId.
• Always verify webhook signatures. Fulfil orders from the verified invoice.paid event, not from a redirect or client callback.
• Client callbacks are UX, not truth. Treat onSuccess in @duckypay/react as a signal to update the UI; the webhook (or the on-chain event) is the source of truth for shipping goods.