# Going live

The sandbox and production run the same API. Moving to production changes the base URL, the keys, and the money.

## Checklist

1. **Review the terms.** Read the [Partner Terms of Service](/terms). You are responsible for offering card packs lawfully where your users live, including age limits and disclosure of odds and prices.
2. **Open production.** Sign in at [partner.packflip.xyz](https://partner.packflip.xyz/dashboard) with the same account and select the same organization. Its production data starts empty.
3. **Create production keys.** Create new keys in production and store them in your production secret store. Sandbox keys do not work there.
4. **Switch the base URL** to `https://partner.packflip.xyz`.
5. **Fund the balance.** Send USDC **on Base** to your production deposit address. Start with a small transfer and wait for it to be credited. There is no test credit in production.
6. **Add production webhooks.** Endpoints are per environment. Store the new signing secret, and check `environment` in each payload so a sandbox event can never be processed as a real one.
7. **Mint on Base.** Production mints use chain ID `8453`; make sure your wallet connection targets Base, not Base Sepolia.
8. **Monitor.** Watch your balance, failed webhook deliveries in the console, and `409 insufficient_balance` responses.

## Keep environments apart

- Use separate configuration for each environment: base URL, API key, and webhook secret together.
- Never point a production build at the sandbox, or the reverse. The console marks the sandbox with an orange banner.
- Never send real users' personal data to the sandbox.

## Security

- Keep API keys on your servers. Never ship them in web or mobile apps.
- Name keys after where they run, and revoke any key you believe has leaked. Revocation takes effect immediately.
- Verify every webhook signature.
- Everyone in your organization can see its keys, balance, and customers. Review members regularly.

## Support

Email [support@packflip.xyz](mailto:support@packflip.xyz) with your account ID (`par_…`) and any operation, card, or event IDs involved.