Going live#

Switch#

	Sandbox	Live
Base URL	`https://manage.test.casapay.com`	`https://manage.casapay.com`
Key prefix	`sk_test_`	`sk_live_`
Payments	Simulator, no money moves	Real EveryPay charges

The key prefix decides the mode, not the URL. A sk_test_ key always creates a test session.

Checklist#

[ ] Live webhook endpoint registered. Test-mode endpoints do not receive live events.
[ ] Signatures verified against the live endpoint secret, using the raw request body.
[ ] Webhook handler is idempotent - success is delivered twice per payment.
[ ] Reconciliation driven by webhooks, not the browser redirect.
[ ] Payout bank account configured for your entity, or collected funds cannot be disbursed.
[ ] Soft payment failures treated as retryable, not terminal.
[ ] API keys stored server-side only, never shipped to a browser or app bundle.
[ ] 429 handled with backoff - 60 requests/minute authenticated, 30 public.

Rotate a leaked key immediately

An entity API key can create agreements and collect payments for your entity. If one is exposed, rotate it from the dashboard under Developers straight away.

Monitoring#

GET /sessions/{id}/logs shows the API and webhook traffic for one session.
The dashboard keeps a delivery log per webhook endpoint, with a manual retry.
Invoice payout_status tells you whether collected money has reached your account.