> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulseshiga.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Go-live checklist

> Everything to verify before switching from sandbox to production.

<Steps>
  <Step title="Swap sandbox keys for production">
    Replace `sk_test_*` with your live secret key in server config only. The key never ships to the browser.
  </Step>

  <Step title="Register your production webhook endpoint">
    Point Pulse at your live `/webhooks/pulse` route and store the signing secret in `PULSE_WEBHOOK_SECRET`. Verify a live event round-trips.
  </Step>

  <Step title="Confirm crediting is webhook-driven">
    <Warning>
      **Credit a customer only after a verified `disbursement.completed` webhook.**
      Client-side callbacks such as `onSuccess` are UX signals — they can be spoofed.
      The signed webhook is the only source of truth for crediting a user.
    </Warning>
  </Step>

  <Step title="Back de-duplication with a shared store">
    On multi-instance deployments, pass `webhookEventStore` (Redis/DB) to the `Pulse` constructor so redeliveries de-dupe across instances.
  </Step>

  <Step title="Set your Content-Security-Policy">
    Allow the embed origin in `frame-src` (see [Embed deployment & CSP](/testing/embed-deployment)).
  </Step>

  <Step title="Run the happy path once against production">
    Create a small real session and confirm `disbursement.completed` credits the user.
  </Step>
</Steps>