Use this checklist when the private production checkout has worked and the next decision is whether the public buy link can go live. The key question is not whether the page loads. The key question is whether payment, webhook, delivery, refund, and support evidence are already attached.
Gate 1
Live config is present, but never public.
Confirm the production API key, store ID, variant ID, and checkout environment exist in private runtime configuration. Do not paste key values into reports, screenshots, GitHub issues, public docs, or client-side code.
Gate 2
The production variant is published.
Check that the variant points to the intended product, uses the current copy, and is not a stale test-mode or unpublished checkout target.
Gate 3
CN¥69 price and currency are verified.
Record the displayed price, minor units, and currency policy. Avoid forcing a mismatched currency with a copied custom_price value.
Gate 4
PayPal checkout renders from the production URL.
If PayPal is the active payment rail, verify it appears on the production checkout page before traffic is sent to the link.
Gate 5
Paid webhooks reach the production route.
A successful checkout must produce the expected paid event, pass x-signature verification, map to the expected product, and create the intended entitlement or delivery state.
Gate 6
Duplicate replay is harmless.
Replay the same paid event and prove delivery emails, licenses, ZIP links, and entitlement writes happen once.
Gate 7
Private delivery and checksum evidence exist.
The paid archive or license should not be published on GitHub Pages. Record the private delivery path and public checksum evidence.
Gate 8
Refund rollback and support notes are ready.
Refund, resend, broken archive, duplicate purchase, and safe issue-reporting behavior should be documented before the public buy link is shared.