Skip to main content
1

Swap sandbox keys for production

Replace sk_test_* with your live secret key in server config only. The key never ships to the browser.
2

Register your production webhook endpoint

Point Pulse at your live /webhooks/pulse route and store the signing secret in PULSE_WEBHOOK_SECRET. Verify a live event round-trips.
3

Confirm crediting is webhook-driven

Credit a customer only after a verified disbursement.completed webhook. Client-side callbacks such as onSuccess are UX signals — they can be spoofed. The signed webhook is the only source of truth for crediting a user.
4

Back de-duplication with a shared store

On multi-instance deployments, pass webhookEventStore (Redis/DB) to the Pulse constructor so redeliveries de-dupe across instances.
5

Set your Content-Security-Policy

Allow the embed origin in frame-src (see Embed deployment & CSP).
6

Run the happy path once against production

Create a small real session and confirm disbursement.completed credits the user.