BillingWebhookKit

Production checkout

Lemon Squeezy production checkout go-live checklist

Use this checklist when the private production checkout has worked and the next decision is whether the public buy link can go live. The key question is not whether the page loads. The key question is whether payment, webhook, delivery, refund, and support evidence are already attached.

Generate readiness report Open launch evidence pack Preview CN¥69 Pro Kit
Gate 1

Live config is present, but never public.

Confirm the production API key, store ID, variant ID, and checkout environment exist in private runtime configuration. Do not paste key values into reports, screenshots, GitHub issues, public docs, or client-side code.

Gate 2

The production variant is published.

Check that the variant points to the intended product, uses the current copy, and is not a stale test-mode or unpublished checkout target.

Gate 3

CN¥69 price and currency are verified.

Record the displayed price, minor units, and currency policy. Avoid forcing a mismatched currency with a copied custom_price value.

Gate 4

PayPal checkout renders from the production URL.

If PayPal is the active payment rail, verify it appears on the production checkout page before traffic is sent to the link.

Gate 5

Paid webhooks reach the production route.

A successful checkout must produce the expected paid event, pass x-signature verification, map to the expected product, and create the intended entitlement or delivery state.

Gate 6

Duplicate replay is harmless.

Replay the same paid event and prove delivery emails, licenses, ZIP links, and entitlement writes happen once.

Gate 7

Private delivery and checksum evidence exist.

The paid archive or license should not be published on GitHub Pages. Record the private delivery path and public checksum evidence.

Gate 8

Refund rollback and support notes are ready.

Refund, resend, broken archive, duplicate purchase, and safe issue-reporting behavior should be documented before the public buy link is shared.

FAQ

When should a Lemon Squeezy checkout URL be public?

Publish the checkout URL only after the production variant is published, CN¥69 price and currency are verified, PayPal renders if it is the active rail, paid webhooks reach the production route, duplicate replay is safe, and delivery or refund rollback evidence is recorded.

Should production API keys be pasted into a checkout readiness report?

No. A readiness report should record whether live keys are configured, never the key values. Keep API keys, webhook secrets, customer data, private checkout URLs, and private download links out of public reports.

Turn the checklist into release evidence

BillingWebhookKit keeps the public work free and browser-only. Start with the report, inspect the free sample, then use the CN¥69 Pro Kit when you need copy-ready fixtures, handlers, tests, and review files in a product repository.