Go live
Sandbox and Production are fully separate: keys, verifications, workflows, webhook endpoints and configuration do not cross over. Going live means recreating the pieces you tested in Sandbox, in Production.
1. Get your business approved
Production identity verification is switched on only after Toden approves your business profile. Complete Onboarding in the console and submit it. Until it is approved, production verify and upload calls return 403 business_not_approved. Sandbox keeps working throughout.
2. Create live keys
In the console, switch the environment selector to Production and create:
Restrict them where you can: a publishable key to the web origins that use it, a secret key to your server IP ranges. A restricted key that is copied elsewhere stops working.
3. Publish your workflow in Production
Workflows are scoped to an environment. Recreate or copy your Sandbox workflow into Production, publish it, and use the Production workflow ID in your live configuration. A Sandbox wf_ ID does not exist in Production.
4. Register production webhooks
Add your endpoint under Developers → Webhooks in Production. It gets its own signing secret.
- Verify the signature on the raw body, and reject timestamps outside the replay window.
- Store each event
idand ignore repeats. - Return
2xxwithin a few seconds and process asynchronously. - Make sure a failed or slow endpoint cannot approve a customer by default.
5. Fund your balance
Production usage draws on prepaid credit. Add credit under Billing and set a low-balance alert so you hear about it before requests are affected. How billing works explains what is charged and when.
6. Point at Production
Remove every sandbox-only field from production requests, including sandboxScenario, metadata.sandboxOutcome and metadata.sandboxDelayMs. Production ignores or rejects them.
7. Test the unhappy paths first
Before launch, confirm your product behaves correctly when things go wrong. Each of these is reproducible in Sandbox with a test ID:
The verification is declined
The customer is told what to do next, and is not granted access.
The verification goes to review
The customer waits in a clear pending state until your team decides. in_review is never treated as approved.
The customer abandons the flow
You receive session.abandoned or see abandoned on the status call, and can send a new link.
A system error occurs
status: "error" is not a decline. Offer a retry and do not record a rejection against the customer.
The same webhook arrives twice
The second delivery changes nothing.
Your request times out
You retry with the same metadata.requestId (identity) or Idempotency-Key (Risk Intelligence) and get the original result, with no duplicate.
Launch checklist
- Business profile approved for Production
- Live keys created, stored in a secrets manager and restricted
- No secret key in client code, logs or a repository
- Production workflow published, and its ID configured
- Production webhook endpoint registered, signature verified, duplicates ignored
- Credit added and a low-balance alert set
- Sandbox-only fields removed from production requests
- Declined, review, abandoned, error and timeout paths tested
- Access decisions made on your backend, never in the browser or app
- The status page bookmarked, and updates subscribed to