Production access
You have tested every outcome in Sandbox Testing: completed, payment failed and expired.
You have asked [email protected] for production access and have your production API key and secret from the Partner Dashboard.
Production uses
https://api.rampnow.io and https://app.rampnow.io, with production keys. No sandbox host or key is left in your production config.Requests
Your API secret is only on your server. It never ships in a browser or mobile app.
Your server clock is synced (NTP). The signature timestamp must be within 1 minute of Rampnow’s time. See Authentication.
Your error handling branches on the error
code, not on message. You show displayError to users when it is present. See Error Codes.Order ids
Every order gets its own unique
externalOrderUid, and you store it before you call Create Order.Before you retry a Create Order call that timed out or failed, look the id up with Get Order. Rampnow does not reject a repeated
externalOrderUid, so a blind retry can create a second order.Webhooks
Your webhook endpoint is set in the API Hub of the Partner Dashboard, subscribed to
ramp_order.status_change, and reachable over HTTPS.You verify the
X-RAMPNOW-SIGN signature on every webhook and reject requests that fail.You return any
2xx fast and do slow work afterwards. Failed deliveries are retried for about 24 hours.You deduplicate on
eventUid, so a retried event is only processed once.Status handling
You handle every status on Order Status, and unknown values don’t break your code.
You treat
failed as in progress, not final. Rampnow operations either retry the order, so it can still reach completed, or block and refund it.You treat
completed, payment_failed, expired, canceled and blocked as final for the user, but still apply later webhooks: a late payment can move a payment_failed or expired order to processing.You reconcile on
dstFillAmount (the amount actually delivered), not on the quoted dstAmount.Return URL
You set
returnUrl on each order, with your own order id in it, so the user lands back on the right page in your app after checkout.You don’t treat the return to your app as proof of payment. A user can come back before paying or after a failure. Read the status from the webhook or Get Order.