Going Live

Moving an integration from test to live changes keys, nothing else.

Keys, not URLs

  • Test keys: sk_test_… (server) and pk_test_… (browser). Live keys: sk_live_… and pk_live_…. Create both pairs in Developers → API Keys.
  • The base URL is the same in both modes: https://api.hlhunt.org/v1. The mode is read from the key prefix and checked against the key record on every request.
  • A test key sees only test data and a live key only live data: charges, customers, payment methods, checkout sessions, refunds and webhook endpoints are all partitioned by mode. A test key retrieving a live charge gets 404; a live key cannot refund a test charge.
  • Test charges are processed by the processor's sandbox; no money moves. Tokens made with pk_test_ live in the sandbox card vault and are not accepted by live keys.

Webhook endpoints are per mode

POST /v1/webhooks with a test key creates a test endpoint that receives only test events; create your production endpoint again with the live key and store its own whsec_ secret. Events carry livemode and environment so a handler can double-check. Webhook endpoints are also scoped to the business the key belongs to.

Checklist

1

Create the live key pair; put sk_live_ in your server's environment, pk_live_ in the page that loads hlhunt.js.

2

Register the live webhook endpoint and verify its signature with the new secret.

3

Keep sending Idempotency-Key on POST /v1/charges and POST /v1/refunds.

4

Handle error.code values, not messages (see Errors), and the two 429 shapes (see Rate Limits).

5

For ACH, support status: "pending" on create and finish the order on charge.succeeded; expect bank accounts to need microdeposit verification first.

6

Make sure your business has completed onboarding; otherwise live calls answer 403 merchant_not_onboarded or processing_disabled.

What does not exist

There is no Node, Python, PHP or Ruby SDK and no MCP server; the only client library is the browser script hlhunt.js (plus hlhunt-checkout.js for embedded checkout). Everything else is plain HTTPS with the examples on each reference page. A machine-readable description of the documented routes is served at https://payments.hlhunt.org/openapi.json.