Going Live

Production checklist before accepting real payments with BSync.

Checklist

• Live API Key — Create a bsync_live_* key in the Dashboard. Store in production secrets manager.
• Production Webhook — Configure HTTPS webhook endpoint in the Dashboard. Verify signatures.
• HTTPS — All endpoints (API calls, webhook receiver, successUrl, cancelUrl) use HTTPS.
• Retry Logic — SDK maxRetries configured. Webhook processing is idempotent by eventId.
• Logging — Log requestId, paymentId, eventId on every API call and webhook.
• Monitoring — Alert on webhook delivery failures, elevated 5xx rates, and rate limit hits.
• Secret Rotation — Plan for periodic API key and webhook secret rotation.
• Verify Signatures — Every webhook verified with verifySignature() before processing.
• Error Handling — All SDK error classes handled. No unhandled promise rejections.
• Alerts — Notify on PAYMENT_REVIEW_REQUIRED, webhook dead_letter, and repeated 500 errors.

Step-by-Step

1. Switch to Live API Key

const bsync = new BSync({
  apiKey: process.env.BSYNC_LIVE_API_KEY,
});

Never commit live keys. Use environment variables or a secrets manager (AWS Secrets Manager, Vault, etc.).

2. Configure Production Webhook

In the Dashboard:

1. Set webhook URL to your production HTTPS endpoint.
2. Copy the webhook secret to BSYNC_WEBHOOK_SECRET.
3. Test with a sandbox payment first, then switch to live.

3. Enable HTTPS

All production URLs must use HTTPS:

• Webhook endpoint: https://api.merchant.com/webhooks/bsync
• successUrl: https://merchant.com/checkout/success
• cancelUrl: https://merchant.com/checkout/cancel

4. Configure Retries and Timeouts

const bsync = new BSync({
  apiKey: process.env.BSYNC_LIVE_API_KEY,
  maxRetries: 3,
  timeout: 30_000,
});

5. Set Up Logging

const bsync = new BSync({
  apiKey: process.env.BSYNC_LIVE_API_KEY,
  logger: {
    warn: (msg, meta) => productionLogger.warn(msg, meta),
    error: (msg, meta) => productionLogger.error(msg, meta),
  },
});

Log every webhook:

logger.info("Webhook received", {
  eventId: event.eventId,
  eventType: event.eventType,
  paymentId: event.data.paymentId,
});

6. Set Up Monitoring

Monitor these metrics:

7. Plan Secret Rotation

1. Create new API key → deploy → revoke old key.
2. Update webhook secret in Dashboard → deploy new BSYNC_WEBHOOK_SECRET → old signatures fail gracefully (return 401, BSync retries with new secret on next delivery).

8. Verify End-to-End

1. Create a small live payment (minimum amount).
2. Complete checkout on the hosted page.
3. Confirm PAYMENT_PAID webhook received and verified.
4. Confirm getStatus() returns paid.
5. Confirm order fulfilled in your system.

Environment Variables (Production)

BSYNC_LIVE_API_KEY=bsync_live_xxxxxxxx
BSYNC_WEBHOOK_SECRET=whsec_xxxxxxxx

What Changes from Test to Live

Related

• Authentication
• Security
• Webhooks
• Best Practices
• Testing