Launch
Going live
A final pass before real orders flow through your integration.
Once your integration works against the test environment, going live is mostly a matter of confirming that every moving part has been exercised at least once with real keys and a real order. Work through the checklist below from top to bottom — each item maps to a part of the flow that, if missed, tends to surface later as missing attribution, double commission, or a payout dispute. When everything is checked and your account has been approved, you are ready to switch your live key on in production.
Go-live checklist
- Live API key approved
- Merchant domain verified
- Product URLs validated (on your approved domain)
- Product feed synced
- Campaign active
- Tracking link tested end to end
- click_id stored through checkout
- Conversion API tested
- Order status API tested
- Webhook signature verified
- Refund / return flow tested (commission reverses)
- Duplicate order test passed (no double commission)
- CSV fallback confirmed (if you use it)
- Merchant dashboard reviewed (logs, failed requests)
- Fraud warnings reviewed
- Admin approval completed
Before you flip to live
The last step is the smallest and the easiest to get wrong: swapping credentials. Rotate every test key out of your production code and replace it with your approved live key, and make sure your signing secret is loaded from a secret manager rather than committed alongside the rest of your config. Then keep an eye on your dashboard as the first real orders land.
Restrict each key to least privilege (optional)
A key can be limited to specific scopes so a leaked credential can do less. Set its permissions.scopes to any of products:read, products:write, campaigns:read, campaigns:write, conversions:write, order-status:write, webhooks:write, events:read (or * for full access). A call outside a key's scopes is rejected 403 INSUFFICIENT_SCOPE. This is opt-in: a key with no scopes set keeps full access, so existing keys are unaffected.
Need to revisit a step? Re-run the flows in testing, confirm signatures in webhooks, check responses against the error reference, and watch everything land in your merchant dashboard.