Go live

Going live is a controlled hand-over, not a flip of a switch. Real money starts to move, so Vestrapay verifies your business first (KYB), and you swap credentials, hosts and webhook URLs. The code of your integration does not change. This guide walks the path in the order you should follow it, and ends with a checklist you can sign off.

Finish sandbox testing

Prove the integration works end to end before you ask for live access.

Complete KYB

Submit your business, identity and settlement details, and wait for approval.

Switch to live credentials and hosts

Use the live dashboard, a live secret key and the live API host.

A public HTTPS URL, verified with your live secret key.

Point callbacks at production

Production callback URL, production checkout return page.

Rehearse a failure on live

Confirm a rejected transfer cannot be simulated on live.

Sign off the checklist

Review every item in the table at the end.

1. Finish sandbox testing

Do not request live access until these four things work in the sandbox at merchant.sandbox.vestrapay.app. They are the things that most often go wrong on the first live day.

Card. A successful payment with a mock card and a declined one. See Test payments.
Transfer. A successful, a failed and an abandoned transfer using the simulate endpoint.
Webhook signature. Your endpoint accepts a correctly signed request and returns 401 for a wrong or missing signature. It reads the raw body, not re-serialised JSON. See Webhooks.
Idempotent fulfilment. Delivering the same webhook twice, and reloading your callback page, fulfils the order once. See Verify a payment.

If you use splits, rehearse them too: add a service in the dashboard, run a payment with a distribution and confirm the allocation. See Services and splits.

2. Complete KYB

Live collection requires an approved business. KYB (know your business) is a three-stage submission that you complete in the merchant dashboard. Each stage saves independently, so you can leave and come back, and the dashboard shows where you are. To start, choose Get started in the dashboard, or open Settings → Developers, and open KYB verification.

Stage	What you submit	Resulting KYB status
1. Business	Business name, category, industry, type, registered address, optional website	`identity_pending`
2. Identity	The fields and documents required for your business category	`settlement_pending`
3. Settlement	The bank account where your money will be paid, checked with the bank	`under_review` once all three stages are complete

After review, the status becomes approved or rejected. The full set of statuses is not_submitted, info_pending, identity_pending, settlement_pending, under_review, approved and rejected.

Stage 1: business

Describe your business: its name, business category, industry and business type, your registered address, and optionally your website. Choose each category from the lists the dashboard shows. The business name falls back to your merchant profile if you leave it out.

Stage 2: identity

The identity requirements depend on your business category, so the dashboard shows the fields and documents that apply to you. Most businesses need a certificate of registration (CAC), a means of ID for the business owner, and a CBN licence where the category requires one. Upload each document in the form (up to 5 MB per file), complete the fields, and save the stage. If a required field or document is missing, the dashboard tells you which one.

Stage 3: settlement

Settlement is where your money goes. Choose your bank and enter the account number. Vestrapay asks the bank for the account holder name and shows it to you. Check that the account name matches your registered business, then confirm. If the confirmation takes too long, or the lookup is rejected, run it again. The account you confirm becomes your primary settlement account. Read Settlement account to understand its role, and how to change it later from Accounts.

Track the status

The KYB verification page shows your current status, what you have submitted, and which of the three stages is complete. If Vestrapay needs more information, or rejects the submission, you are told what to fix. Questions go to tech@vestrapay.com.

You complete KYB before live access exists, from the dashboard you are signed in to. If you need to automate KYB submissions, dashboard APIs exist for it. Contact tech@vestrapay.com for access details.

3. Switch to live

When KYB is approved and live mode is activated for your account, live credentials are issued.

Sign in to the live dashboard at merchant.vestrapay.com.
Open Settings → Developers and copy the live secret key, which starts with sk_live_.
Store it in your production secrets manager as a new value. Do not overwrite the sandbox key in your development environments.
Point your production configuration at https://api.vestrapay.com/v1.
Confirm checkout links now begin with https://checkout.vestrapay.com.

Until KYB is approved, live keys do not exist and live payment attempts fail with merchant.kyb_not_approved. If KYB is approved but live access is still refused with live_mode_not_enabled, contact tech@vestrapay.com. Everything you configured in the sandbox, including services, sub-accounts, splits, partner users, payment links and webhook endpoints, is separate on live. Recreate what you need. See API keys and environments.

4. Register a live webhook

Sandbox webhook endpoints do not receive live events. In the live dashboard, open Settings → Developers → Webhooks and add your production endpoint.

Use a public HTTPS URL on a valid certificate.
Subscribe to payment.completed, payment.failed and payment.abandoned.
Point your live webhook verifier at the live secret API key (sk_live_…). Sandbox deliveries are signed with sk_test_….
Deploy the live secret key to production before you take the first payment.

The URL must resolve to a public address, so localhost and private network addresses are rejected. See Webhooks.

5. Use production callback URLs

Set callbackUrl on initialise, and redirectUrl on payment links, to production pages on your own domain. Check them for the usual traps: a staging hostname left in configuration, HTTP instead of HTTPS, and a callback route that is behind a login the customer does not have in that browser session. The callback receives status, reference, amount and currency as query parameters. The page should show the customer a result, and your server should still confirm with verify before fulfilling.

6. Simulate a transfer rejection on live

The transfer simulate endpoint exists only in the sandbox. Before launch, prove that nothing in your system relies on it:

curl -X POST https://api.vestrapay.com/v1/payment/checkout/charge/bank-transfer/simulate \
  -H "x-access-code: LIVE_ACCESS_CODE" \
  -H "Content-Type: application/json" \
  -d '{ "scenario": "failed" }'

The call must be rejected with HTTP 403. This confirms that nobody can fake a payment outcome in production and that your tooling uses the right host. If you see it succeed, stop and contact tech@vestrapay.com immediately. Then make one small real payment of your own, ideally by card and by transfer, and follow it through the webhook, verify and fulfilment. Refund it through your normal process if you do not want to keep it.

7. Go-live checklist

Area	Check	Done
Testing	Card success and decline tested	☐
Testing	Transfer success, failure and abandonment tested	☐
Testing	Webhook rejects bad signatures and reads the raw body	☐
Testing	Fulfilment is idempotent across webhook retries and page reloads	☐
Testing	Amount mismatch is refused	☐
KYB	Business, identity and settlement stages complete	☐
KYB	Status is `approved`	☐
KYB	Settlement account name matches your registered business	☐
Credentials	Live secret key (`sk_live_`) in production secrets, never in code	☐
Credentials	API base URL is https://api.vestrapay.com/v1	☐
Webhooks	Live HTTPS endpoint registered; verifier uses live secret API key	☐
Webhooks	Subscribed to payment.completed, payment.failed and payment.abandoned	☐
URLs	Production callbackUrl and redirectUrl set	☐
Splits	Services, sub-accounts and splits recreated and checked on live, if used	☐
Partners	Partner users invited and service permissions assigned, if used	☐
Safety	Transfer simulate returns 403 on live	☐
Safety	One real payment followed end to end	☐
Operations	Logging captures reference and X-Request-Id for every call	☐
Operations	Support route to tech@vestrapay.com known to your team	☐

Support

Email tech@vestrapay.com with your merchant name, the reference of any payment involved and the X-Request-Id of any failing call.

Get started

Accept payments

Services & splits

Partners

Settlements

1. Finish sandbox testing

2. Complete KYB

Stage 1: business

Stage 2: identity

Stage 3: settlement

Track the status

3. Switch to live

4. Register a live webhook

5. Use production callback URLs

6. Simulate a transfer rejection on live

7. Go-live checklist

Support

​1. Finish sandbox testing

​2. Complete KYB

​Stage 1: business

​Stage 2: identity

​Stage 3: settlement

​Track the status

​3. Switch to live

​4. Register a live webhook

​5. Use production callback URLs

​6. Simulate a transfer rejection on live

​7. Go-live checklist

​Support

1. Finish sandbox testing

2. Complete KYB

Stage 1: business

Stage 2: identity

Stage 3: settlement

Track the status

3. Switch to live

4. Register a live webhook

5. Use production callback URLs

6. Simulate a transfer rejection on live

7. Go-live checklist

Support