Going live

The sandbox and production run the same API. Moving to production changes the base URL, the keys, and the money.

Checklist

1. Review the terms. Read the Partner Terms of Service. You are responsible for offering card packs lawfully where your users live, including age limits and disclosure of odds and prices.
2. Open production. Sign in at partner.packflip.xyz with the same account and select the same organization. Its production data starts empty.
3. Create production keys. Create new keys in production and store them in your production secret store. Sandbox keys do not work there.
4. Switch the base URL to https://partner.packflip.xyz.
5. Fund the balance. Send USDC on Base to your production deposit address. Start with a small transfer and wait for it to be credited. There is no test credit in production.
6. Add production webhooks. Endpoints are per environment. Store the new signing secret, and check environment in each payload so a sandbox event can never be processed as a real one.
7. Mint on Base. Production mints use chain ID 8453; make sure your wallet connection targets Base, not Base Sepolia.
8. Monitor. Watch your balance, failed webhook deliveries in the console, and 409 insufficient_balance responses.

Keep environments apart

• Use separate configuration for each environment: base URL, API key, and webhook secret together.
• Never point a production build at the sandbox, or the reverse. The console marks the sandbox with an orange banner.
• Never send real users' personal data to the sandbox.

Security

• Keep API keys on your servers. Never ship them in web or mobile apps.
• Name keys after where they run, and revoke any key you believe has leaked. Revocation takes effect immediately.
• Verify every webhook signature.
• Everyone in your organization can see its keys, balance, and customers. Review members regularly.

Support

Email support@packflip.xyz with your account ID (par_…) and any operation, card, or event IDs involved.