Going live

The live API base is https://api.maxanapay.com; sandbox uses

https://staging.api.maxanapay.com. A production launch can use Hosted Checkout, Embedded Checkout, or the published browser SDK when its current capabilities match the session.

Launch checklist

• Replace the sandbox API key with a live key from production secret storage. Do not ship either key to the browser.
• Configure the live API base explicitly and remove test-only API overrides.
• Register exact production checkout origins and final HTTPS return locations.
• Create or rotate the production webhook secret, verify Maxana-Signature against the raw body, and exercise duplicate delivery handling.
• Test declines, cancellations, expiry, timeouts, idempotent retries, partial refunds, disputes, and rate limiting without treating a browser callback as proof of capture.
• Confirm your CSP admits the selected Maxana API and checkout origins plus the provider resources your chosen payment rail actually loads. If you use the browser SDK, load only its published channel or a ledger-recorded exact version.
• Confirm PCI scope with your assessor for the final deployed integration.

Keep a rollback path that restores the previous application configuration without reusing or exposing revoked credentials.

Current limits

Sandbox success does not enable a live merchant, copy credentials, or carry provider state into production. The browser SDK is limited to its documented PayPal wallet rail; use Hosted Checkout or Embedded Checkout for excluded capabilities.