# Going live

Moving from sandbox credentials to real merchants.

## Checklist

1. App approved and published.
2. Payout account verified in **live** mode (real entity, real bank account).
3. Billing method on file for the publishing fee.
4. Live redirect URIs registered (HTTPS, exact).
5. Webhook endpoint deployed on a public HTTPS URL with signature verification.
6. Secrets stored server-side; no client id/secret pair in front-end code.

## What changes

| | Sandbox | Live |
| --- | --- | --- |
| Tokens | `sb_at_test_…` | `sb_at_live_…` |
| Read quota | 120 req/min per install | 600 req/min per install |
| Data | Your test merchant | Real merchants |
| Disputes | Simulated | Real money at stake |

## First 24 hours

Watch **Logs** for `401`, `403 insufficient_scope` and `429` — those three cover almost every launch bug. Set your alert threshold at 1 % error rate for the app.

## Rollback

If something is wrong, unpublish the app. Existing installations keep working, but no new merchant can install while you fix it.