---
title: Testing and going live
description: Test Terudo integrations with the public demo key, test keys and the sandbox, simulate payments and webhooks, then the go-live checklist.
---

# Testing and going live

## Three levels

| Key | What works | What does not |
| --- | --- | --- |
| Demo `pk_test_terudo_demo_public` (no account) | Real catalogue, prices, quotes, coverage and compatibility checks, Elements rendering | Checkout (`403 demo_key`): no payment link, no order |
| Your `pk_test_…` / `sk_test_…` | Everything: orders, simulated payment on the pay page, sandbox eSIMs, webhooks to test endpoints | Nothing is charged, delivered for real or billed |
| Your `pk_live_…` / `sk_live_…` | Real sales | |

Test sales never appear in statements or invoices. A test eSIM page looks like a real one but the eSIM cannot be installed.

## Simulate a payment

With a `pk_test_…` key in Elements, or an order created with `sk_test_…`, open `checkout_url`: the pay page offers to simulate a successful payment. The order then becomes `paid`, then `delivered`, and your test webhook endpoints receive `order.paid` and `order.delivered`.

## Test webhooks

- `POST /webhooks/{id}/test` (or the portal button) sends a signed test event now.
- `terudo webhooks trigger <event> --url http://localhost:… --secret whsec_…` (see [CLI](https://terudo.com/developers/docs/cli.md)) signs a sample event with your secret and posts it to your local server, to check your signature code before deploying.

## Go-live checklist

1. Terudo has opened the API for your account (ask your Terudo contact).
2. Live keys created in the portal. The publishable key lists the sites that use it (`https://www.your-agency.example`), so return URLs from your pages are kept.
3. Secret key in your server's secrets, never in a page, an app bundle or a repository.
4. Webhook endpoint created with the live key, its `whsec_…` secret stored, signature verified on the raw body, duplicates ignored by event id.
5. Every order carries your `reference`, so retries never duplicate.
6. Net orders: prepaid credit topped up in the portal (Développeurs) and `402 insufficient_credit` handled.
7. Content Security Policy allows `https://terudo.com` for scripts, connections and images.
8. One real purchase made and refunded (`POST /orders/{id}/cancel` while not installed) to see the whole path.