Go-Live Checklist

Work through this list before you switch your Web SDK integration from sandbox to production.

Test in Sandbox

A card payment succeeds with each sandbox test card.
All three 3DS outcomes behave correctly: frictionless, challenge, and declined. See the sandbox thresholds on 3DS Authentication.
Declined payments, a cancelled 3DS challenge, and network errors show the shopper a clear message and let them retry. See Error Handling.
If you offer them: QR, Apple Pay and Google Pay each complete a payment end to end.
Your backend receives the webhook for every final status and updates the order from it, not from the browser result. See Webhooks.

new Bahn({ environment: "production" }). Don't rely on the default: if environment is left out, the SDK uses "sandbox".
Use your production publishable key.
Load a pinned SDK version with its integrity hash and crossorigin="anonymous". See Environments → Script Bundle Versioning & Integrity.
If your page sets a Content Security Policy, allow the production hosts. See Environments → Content Security Policy.
Serve your checkout page over HTTPS.

Your backend calls https://bn.cake.vn with the production API key and signing key.
The API key stays on your servers and never appears in browser code, logs, or your repository.
Your production webhook URL is registered with Bahn and verifies signatures. See Webhook Signatures.

Apple Pay: your production domain is registered with Apple and with Cake. See Apple Pay → Requirements.
Google Pay: confirm with Cake that Google Pay is configured for your production merchant. If it isn't, the button emits an error event with the message "Google Pay is not configured for this merchant".

Make a small real payment in production and confirm the webhook arrives.
Monitor failed payments and SDK errors (err.name === "APIError") in your logging.