Skip to main content
There is no separate test environment to switch away from: you have been building against production all along (see Testing your integration). Going live is about making sure the integration is solid and that nothing from development is left behind.

​
Before launch

1

Your integration passes end to end

  • A token is minted from your server and cached for its hour.
  • Events list and render, with fees shown exactly as returned.
  • Hosted or embedded checkout completes on your production origin, and your server verifies the session (status: "complete") before fulfilling.
  • Custom UI: an order is created, paid to your own number, and reaches paid.
  • Your webhook receiver verifies the signature on the raw body, dedupes on X-Laces-Delivery, and answers 2xx within 10 seconds.
  • Send test event in the app gets a 2xx from your production receiver, and a real test order produced order.paid.
2

Error handling is in place

  • You branch on error_code, never on the error text, and you log X-Request-Id with every error.
  • Retries reuse the same Idempotency-Key.
  • 429 honours Retry-After.
  • payments_enabled: false shows “registration not open” instead of a buy button.
  • prompt_in_progress waits; it is not treated as a failure.
3

Secrets are where they belong

  • The client secret and webhook signing secret are in your secret manager or server environment, not in source control, not in a browser bundle, not in a mobile app.
  • Only the publishable key appears in page source.
  • Your base URL is https://connect.laces.run/v1 everywhere.

​
Tidy up

1

Use a key for production only

Ideally your production site has its own API key, separate from the one you developed with. If you developed with this key, consider Regenerate keys so any copy of the secret on a laptop stops working after 24 hours.
2

Remove local domains

Remove every http://localhost:<port> and http://127.0.0.1:<port> entry from the production key’s Allowed domains and Return URL domains. The app marks a key that still has one with “Local development domain: remove before launch”. Make sure your production origins are listed, and list both https://example.com and https://www.example.com if you serve both.
3

Point webhooks at production

In Settings → Developers → Webhooks, make sure the endpoint URL is your production receiver, not a tunnel, and that the server holds its current signing secret. Delete endpoints you only used for development.
4

Retire the test event

Close, end or delete the unlisted test event, and refund any paid test orders from the Laces app. The Partner API lists unlisted events, so a forgotten test event can appear on your site.
5

Launch and watch

Switch your site’s Register buttons on. Make one small real purchase end to end, confirm the order.paid webhook arrives, and refund it if you need to.

​
After launch

  • Use one API key per site, so you can revoke one without affecting the others. An organization can hold up to 10 active keys.
  • Regenerate keys periodically. The old secret keeps working for 24 hours, but the old publishable key stops immediately, so update your pages straight away.
  • Watch for webhook failures. After 50 consecutive failed attempts Laces disables the endpoint; re-enable it in the app once your receiver is fixed.