Go-live checklist

What you'll buildCopy Anchor Link

The live version of an integration that works in test mode. Live data starts empty, keys and webhook endpoints are separate from test ones, and every live launch spends a launch you bought. This page walks through each change, then a first real launch to watch.

Before you startCopy Anchor Link

• An integration that works in test mode, from creating a project to handling webhooks.
• Your first purchase. Live keys come with it, and every launch on the live side uses 1 launch from your balance.

1. Create a live keyCopy Anchor Link

In the console, open Developers and create a key on the LIVE tab. Store it in your secret manager, apart from the test key, and point your production config at it.

curl https://api.submitator.com/v1/ping \
  -H "Authorization: Bearer $SUBMITATOR_API_KEY"

{
  "object": "ping",
  "ok": true,
  "livemode": true,
  "account": { "name": "Northlight Studio", "state": "active" },
  "key": { "id": "key_3Rw8Kx2Lq9Vt5Nb1Zm7HcW", "permissions": "full" }
}

• livemode is true and state is active.
• Each server or job has its own key, so you can roll one without touching the others.
• Anything that only reads, such as a dashboard, has a read_only key. A portal that shows your client their logins needs a key with full permissions.
• No key is in a browser, an app or a repository.

2. Add your live webhook endpointCopy Anchor Link

Webhook endpoints belong to a mode, so the endpoints you added with the test key receive no live events. Add the live one with the live key: it gets its own secret, and its URL must be public, since live mode rejects hosts on .test such as the one below.

curl https://api.submitator.com/v1/webhook_endpoints \
  -H "Authorization: Bearer $SUBMITATOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://hooks.northlight.test/listings", "events": ["listing.*", "project.*", "report.*"]}'

• The live endpoint's secret is stored, and your code checks live deliveries with it.
• POST /webhook_endpoints/{webhook_endpoint_id}/test reaches the live endpoint and gets 2xx.
• Your code skips an event whose id it has handled, and checks livemode before it writes.

3. Switch to your clients' real dataCopy Anchor Link

Test projects stay in test mode: a live key gets 404 for their ids. Create each client's project again with the live key, from their real site.

• Sites are public: live mode rejects .test, .example, .invalid, .localhost and IP addresses with not_public_url.
• Each contact email is one your client reads, since some directories register the listing to it, and it cannot change after the launch.
• external_id holds your CRM's id, so your records link to the live projects.
• Tests that use nobadge. hosts or /fail.png images to force a failure run in test mode only.

4. Check the errors your code can getCopy Anchor Link

• Your code branches on error.code, never on message, and logs request_id.
• Every POST you may send twice carries an Idempotency-Key, and a retry sends the same key.
• 429 waits the seconds in Retry-After; 500 and 503 retry with backoff.
• 402 no_launches_left stops your launches and tells you to buy more, instead of retrying.
• A listing or project in action_required reaches a person: client_message goes to your client when waiting_on is client.

Error codes says what each code means and how to fix it.

5. Launch one project and watch itCopy Anchor Link

Before the first real launch, preview it: the readiness call is free and shows what the launch would spend and get.

curl https://api.submitator.com/v1/projects/prj_4QzX1m9Lr2Vb7Nc8Tk3HwP/readiness \
  -H "Authorization: Bearer $SUBMITATOR_API_KEY"

• ready is true, and cost.available covers the launch.
• After the launch, project.launched reaches your live endpoint.
• Listings move from pending over the next days, and most go live within a week.

Check it workedCopy Anchor Link

• GET /ping with the production key shows livemode true.
• GET /webhook_endpoints with the same key lists your live endpoint, enabled and with a recent delivery_summary.last_http_status of 2xx.
• Your system shows the first live project's listings, and their statuses match progress on the project.

What can go wrongCopy Anchor Link

Next stepsCopy Anchor Link

• Authentication: keys, permissions, rolling and revoking.
• Rate limits: 3,600 requests per hour in each mode.
• Support: what to send when something looks wrong.