Going live checklist

Test mode and Live mode are separate apps, with their own IDs, keys, settings, and data. Nothing you set up in Test mode carries over. Work through this list in Live mode before you take real payments.

1. Verify the team owner's email

A Live app works only once the team's owner has verified their email. Until then, Live requests return 403 with code email_unverified, and customers can't pay. Test mode works without it.

{
  "code": "email_unverified",
  "error": "the team owner must verify their email to use live"
}

2. Connect a payment provider

A Live app takes payments through your own pawaPay, Notch Pay, or Flutterwave account. In the dashboard, open Settings, then Payments, and connect it.

Use production credentials. If you tested with your provider's sandbox, those credentials don't work here: Notch Pay sandbox keys and Flutterwave test keys fail with code provider_live_credentials_required, and pawaPay refuses a sandbox token with provider_credentials_rejected. pawaPay creates a token only once a callback URL is set, so set a temporary one first, then replace it in step 3.

Without a provider, checkouts and payments return 422 with code not_accepting_payments.

{
  "code": "not_accepting_payments",
  "error": "this app isn't accepting payments yet"
}

See Connecting a payment provider for the credentials each provider needs.

3. Set the webhook URL in your provider

This step is required. After you connect, the Payments page shows a Webhook URL. Paste it into your provider's dashboard, so payments update as soon as customers approve them. Until it's set, payments may not update in Abuna, and paid invoices can stay open.

• pawaPay: open System configuration, then Callback URLs, and paste it as the Deposits callback URL, in place of the temporary one.
• Notch Pay: open Settings, then Webhooks, add an endpoint with the URL, and turn on the payment events. If Notch Pay then shows a different hash key for the endpoint, enter it in Abuna as the Webhook hash key.
• Flutterwave: open Settings, then Webhooks, paste the URL, and enter the same Secret hash you entered in Abuna. Tick Enable webhook retries and Enable webhook for failed transactions, then save.

See Set the webhook URL in your provider for how to check that it works.

4. Switch to your Live app ID and key

Your server picks the mode by the app ID in the path and the key it sends. Change both together: the Live app ID, and a secret key that starts with sk_live_.

curl https://api.abuna.app/v1/apps/01J9ZQ4Y7R3T6V8W2X5B1C0DEF/products \
  -H "Authorization: Bearer sk_live_..."

• Abuna shows a secret key once, when it's created. A team owner can create more keys under Settings, API keys, and revoke one that leaks.
• Keep secret keys on your server. Never put them in a browser or mobile app.

5. Create your products and prices in Live mode

Live mode starts empty. Create your products and prices again in the Live app, and store their Live IDs. Test IDs don't exist in Live mode.

6. Set up your Live webhook endpoint

A Test app never copies the Live endpoint, and the Live app doesn't copy yours from Test. In Live mode, open Webhooks and set the Endpoint URL. It must be a public https URL.

• Use the Live signing secret, which starts with whsec_live_. Your Test secret won't verify Live events.
• Verify X-Abuna-Signature and X-Abuna-Signature-Previous on every request.
• Click Send test event and check that your endpoint answers 2xx.
• If one server handles both modes, route on environment in the signed body, not only on the X-Abuna-Environment header.

See Receiving webhooks for the full setup.

7. Check your Live settings

Your app's name, support contact, and terms URL are shared by both modes. Its redirect URLs, time to pay, and webhook endpoint are set per mode. In Live mode, open Settings, then General:

• Customer support: add a support email or URL. It appears in every customer email, and on your hosted checkout, pay links, and customer portal.
• Redirect URLs: where the hosted checkout sends customers back. Each one must be an absolute https URL. The success_url and cancel_url you pass to a checkout session must be https in Live mode too. A localhost URL that worked in Test mode returns 422.
• Time to pay: how many days, 1 to 14, a customer has to pay a renewal before the subscription is canceled. It applies to invoices issued after you change it.
• When customers cancel: whether a customer who cancels in the customer portal keeps the subscription until the end of the paid period (the default) or loses it right away. Test and Live each have their own setting.

8. Check your plan

Only Live mode counts toward your plan. The Free plan allows 20 Live subscribers and 1 app per team. At the limit, new customers can't subscribe, and your hosted checkout tells them you aren't taking new subscribers. If you expect more, move to a bigger plan before you launch.

9. Make one real payment

Subscribe to your own product with a small price, through a checkout session, and pay it with your own mobile money wallet. Check that you get the receipt email, that your endpoint receives session.completed, invoice.paid, and subscription.paid, and that the money reaches your provider account. The Payments page should then say Receiving updates.