Going to Production

This guide covers everything required to move from sandbox testing to live production payments.

#Environment URLs

Both environments use identical API contracts. All endpoints, request/response schemas, and webhook formats are the same.

TLS requirement: All API communication must use TLS 1.2 or higher. Connections using older TLS versions are rejected.

#Rate Limits

Production API traffic is limited to 40 requests per minute per IP address.

If your server IPs are whitelisted, this rate limit does not apply. Contact your assigned account manager to whitelist your production IP addresses before going live.

#Credentials

#Obtaining Production Credentials

1. Contact the Exirom operations team to request production credentials
2. You'll receive a Merchant Key and Merchant Secret for production
3. These are different from your sandbox credentials — sandbox tokens do not work in production

#Credential Management

• Store credentials in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.)
• Never hardcode credentials in source code or commit them to version control
• Use separate credentials per environment (sandbox, staging, production)
• Rotate credentials immediately if they are exposed

#Token Caching

Tokens are valid for 30 days. Cache and reuse tokens — do not authenticate per request. Refresh proactively at day 29 rather than waiting for a 401.

If a 401 Unauthorized is received, discard the cached token, re-authenticate, and retry the original request once.

→ See Authentication Flow for the full token lifecycle and error reference.

#Webhook Configuration

#Endpoint Requirements

Your webhook endpoint must:

• Accept POST requests with JSON body
• Respond with 200 OK within 10 seconds
• Be publicly accessible (no localhost, no VPN-only)
• Support HTTPS (TLS 1.2+)

#Verify Signatures

Always verify the X-Checksum header in production. See the Webhook Best Practices guide.

#Test Your Endpoint

Before going live, verify your webhook endpoint handles:

• Successful payment callbacks
• Failed payment callbacks
• Duplicate deliveries (same callback twice)
• Out-of-order callbacks
• APM callbacks with apmType parameter
• Invalid/missing X-Checksum (should reject)

Use tools like ngrok or webhook.site during development to inspect callback payloads.

#Monitoring & Alerting

#Key Metrics to Track

#What to Log

For every API call, log:

• requestId — your unique identifier for correlation
• transactionId — Exirom's identifier (from response)
• traceId — included in error responses for Exirom support
• HTTP status code
• transactionStatus and declineCode
• Timestamp

When contacting Exirom support, always include the transactionId and traceId. This dramatically speeds up investigation.

#PCI DSS Compliance (Card API Only)

If you use the Card API (direct card data collection), you are in PCI DSS scope:

If using Card API:

• You must complete SAQ-D self-assessment or Level 1 audit
• Card data must be transmitted over TLS 1.2+ only
• Never log full card numbers — use masked format (4111********1111)
• Never store CVV after authorization

If PCI scope is a concern, consider using the Hosted Payment Page instead — it handles card data on Exirom's PCI-certified infrastructure.

#Pre-Launch Checklist

#Configuration

• Production credentials obtained and stored securely
• API base URL points to https://api.exirom.com/api (not sandbox)
• Webhook endpoint is HTTPS and publicly accessible
• Webhook signature verification is enabled
• Correct mid / accountId for production
• Production IP whitelist confirmed with your assigned account manager, if needed

#Code Quality

• Idempotency implemented (unique requestId per transaction, reused on retry)
• Webhook deduplication in place
• Error handling covers all decline codes
• Token caching with proactive refresh
• 401 retry logic implemented
• Polling fallback for missed webhooks

#Testing

• Full payment flow tested in sandbox (initiate → 3DS → webhook → fulfill)
• Refund flow tested
• Payout flow tested (if applicable)
• Webhook failure/retry tested
• All supported currencies tested

#Operations

• Monitoring dashboards set up
• Alerting configured for key metrics
• On-call process defined for payment failures
• Exirom support contact saved (for escalation)
• Settlement process confirmed with Exirom operations team

#Sandbox vs Production Differences

Important: Sandbox tokens, transaction IDs, and card tokens are not valid in production. Do not attempt to use sandbox data in the production environment.

#API Health & Support

If you suspect an outage or degraded performance, contact the Exirom support team. Include:

• Affected transactionId(s) and traceId(s) from error responses
• Time range and approximate volume of affected transactions
• Your mid

Contact: support@exirom.com — or your assigned account manager

For active production failures, mark your ticket as P1/Critical for expedited response.

#See Also

• Integration Checklist — track your progress from setup to go-live
• Common Integration Mistakes — avoid frequent pitfalls
• Webhook Best Practices — production-grade callback handling