# Going live

> Business verification, live keys and the checklist to run before the first real payment.

Source: https://rais.app/docs/going-live

Going live is a change of **key**, not of code: the same API, the same URLs and the same objects. Before that, your business has to be verified, and a few settings have to be real.

## 1. Verify your business

Live payments need a verified business. The sandbox stays available while you do it. In the dashboard, open **Verification**; it takes you through five steps and you can save and come back later:

1. **Business details.**
2. **Legal documents.** Your commercial register, NIF and NIS numbers, each with its document (type each number as it is written on the document), and the agreement (agrément) if your activity needs one.
3. **Owners.** The legal representative and every other owner of 25% or more, each with an identity document.
4. **Merchant agreement.** Read the Raïs merchant agreement, then sign it, drawn or typed, as an owner or administrator of the business. The signed copy stays available as a PDF, and the text can be read without signing in.
5. **Review and submit.**

Files can be PDF, JPEG, PNG or WEBP, up to 10 MB each. The Raïs team reviews the application and tells you the outcome; if something is missing, the review message says what to change and you can resubmit.

Until your business is approved:

- `GET /account` shows `live_enabled: false`.
- The dashboard creates no live key and no live webhook endpoint. A live key can only exist for an approved store, and it stops working the moment the store is no longer approved: the API then answers `401 invalid_api_key`, like for any key it refuses.
- Everything in the sandbox keeps working.

## 2. Create a live key

When the business is approved, open **Developers**, then **API keys**, press **Create key** and choose **Live** in the dialog: the key starts with `rais_sk_live_`. Store it in your production secret manager, next to nothing else. Keep the sandbox key for staging.


**Request**

```bash
curl https://api.rais.app/v1/account \
  -H "Authorization: Bearer rais_sk_test_..."
```


With the live key, `livemode` is `true` and `live_enabled` is `true`. See [Authentication](https://rais.app/docs/authentication.md).

## 3. Register a live webhook endpoint

Sandbox endpoints do not receive live events. In **Developers**, then **Webhooks**, add an endpoint, choose **Live** in the dialog, give it an `https://` address, and keep its own signing secret. Check that your server:

- verifies the signature on the raw body, and rejects old timestamps;
- answers `2xx` within 10 seconds, and does slow work afterwards;
- processes each event once, using its `id`.

See [Webhooks](https://rais.app/docs/webhooks.md).

## 4. Use https everywhere

- **Webhook endpoints.** A live endpoint must use `https://`.
- **Return URLs.** `success_url` and `cancel_url` of a live payment must use `https://`, or your own app scheme. `http://` is accepted in the sandbox only. Store defaults follow the same rule.
- **Your own pages.** The pages the payer returns to should be https too.

## 5. Checklist


> [!TIP]
> **Before the first real payment**
>
> - The business is approved and `GET /account` shows `live_enabled: true`.
> - The live key is in your secret manager and not in code, logs, mobile apps or tickets.
> - Payments are created on your server, with the amount computed there.
> - Every payment creation and every refund sends an `Idempotency-Key`.
> - The live webhook endpoint is registered, verified and idempotent.
> - Return pages confirm the payment with the API or the webhook, never from the address, and do not cancel the order because of `status=failed`: the payer may try again.
> - Unpaid orders are closed by your own timer or by retrieving the payment after `expires_at`: nothing is sent when a payment expires.
> - You know what a payment and a refund cost (see [Pricing and fees](https://rais.app/docs/pricing.md)), and your balance can cover the refunds you may issue: a live refund and its fee are taken from it.
> - Errors are handled by type, `429` and `5xx` are retried with backoff, and request ids are logged. See [Errors](https://rais.app/docs/errors.md).
> - You alert on failed webhook deliveries.
> - Your terms and refund policy are published for your customers.


## 6. Take a first real payment

Create a payment for the smallest amount, 50.00 DA, with a real card. Check that the payment is `paid`, that your webhook arrived and was processed once, and that the receipt opens. Then refund it, and check the `refund.succeeded` event. A live refund comes out of your store's balance together with its fee (10.00 DA), so the balance must cover both: a store that has just received one payment can refund at most its balance minus 10.00 DA.

## Test and live compared

|  | Sandbox | Live |
| --- | --- | --- |
| Key | `rais_sk_test_...` | `rais_sk_live_...` |
| Base URL | Same | Same |
| Availability | Always | After business verification |
| Cards | SATIM test cards | Real CIB and Edahabia cards |
| Money and balances | Nothing moves | Credited and debited |
| Fees | Shown, simulated: nothing is charged | Charged on each paid payment and each refund |
| Return URLs | `https://`, `http://` or your app scheme | `https://` or your app scheme |
| Webhook endpoints | `https://` or `http://` | `https://` only |
| Receipts | Marked as a test | Official |
| Test wording on the checkout | "Test mode" banner | Never shown |

## Rate limits

Each key may send 60 requests a second, in bursts of up to 120. See [Rate limits](https://rais.app/docs/rate-limits.md).