Testing and going live

Three levels

Key	What works	What does not
Demo pk_test_terudo_demo_public (no account)	Real catalogue, prices, quotes, coverage and compatibility checks, Elements rendering	Checkout (403 demo_key): no payment link, no order
Your pk_test_… / sk_test_…	Everything: orders, simulated payment on the pay page, sandbox eSIMs, webhooks to test endpoints	Nothing is charged, delivered for real or billed
Your pk_live_… / sk_live_…	Real sales

Test sales never appear in statements or invoices. A test eSIM page looks like a real one but the eSIM cannot be installed.

Simulate a payment

With a pk_test_… key in Elements, or an order created with sk_test_…, open checkout_url: the pay page offers to simulate a successful payment. The order then becomes paid, then delivered, and your test webhook endpoints receive order.paid and order.delivered.

Test webhooks

• POST /webhooks/{id}/test (or the portal button) sends a signed test event now.
• terudo webhooks trigger <event> --url http://localhost:… --secret whsec_… (see CLI) signs a sample event with your secret and posts it to your local server, to check your signature code before deploying.

Go-live checklist

1. Terudo has opened the API for your account (ask your Terudo contact).
2. Live keys created in the portal. The publishable key lists the sites that use it (https://www.your-agency.example), so return URLs from your pages are kept.
3. Secret key in your server's secrets, never in a page, an app bundle or a repository.
4. Webhook endpoint created with the live key, its whsec_… secret stored, signature verified on the raw body, duplicates ignored by event id.
5. Every order carries your reference, so retries never duplicate.
6. Net orders: prepaid credit topped up in the portal (Développeurs) and 402 insufficient_credit handled.
7. Content Security Policy allows https://terudo.com for scripts, connections and images.
8. One real purchase made and refunded (POST /orders/{id}/cancel while not installed) to see the whole path.