Going live
No approval queue. When your code passes against sandbox, switch the host and mint a live key.
Pre-flight checklist
- Idempotency on every write. See the guide.
- Webhook signature verification. Constant-time compare, 5-minute window. Snippets.
- Dedupe by event id. Webhooks are at-least-once.
- Handle 429 with backoff. Read
Retry-After. - Log
X-Request-Id. Quote it in support tickets.
Mint a live key
Adeva Pro client console → Developer → API keys → Create. Pick minimum scopes. Secret shown once.
Switch the host
| Environment | Host | Key prefix |
|---|---|---|
| Sandbox | sandbox.adevapro.com.au | ak_test_ |
| Production | api.adevapro.com.au | ak_live_ |
Wrong-mode keys get
401 unauthenticated at the auth layer. There's no path where a production key touches sandbox data or vice versa.Zero-downtime rotation
- Mint a new key with the same scopes.
- Roll it out across all instances.
- Revoke the old key.
Same approach for webhook signing secrets: rotate via PUT /v1/webhooks with rotateSecret: true, deploy your receiver with both old + new accepted for a few minutes, then drop the old.