Go live

Move your integration from staging to production.

Requirements

Requirement	Description
A signed agreement	With Zay
A complete staging path	A payout that reached received, and a successful webhook delivery, for your staging merchant — see Test your integration

How it works

1. Ask for production access
2. Switch your configuration
3. Register your production webhook endpoint
4. Check your integration against the list
5. Make a first small payout

1. Ask for production access

Once the agreement is signed and your staging path is complete, ask your Zay contact in your shared Slack channel. Zay checks the staging path from its own data — no demo call — and sends you production credentials: a new merchant id and private key. The key arrives as a one-time link; store it in your secret manager straight away.

2. Switch your configuration

Nothing from staging carries over to production — credentials, users, webhook endpoints and signing secrets are all separate.

Setting	Staging	Production
API base URL	https://api-connect.zay.me	https://api.zay.me
Onboarding host	privy-stag.zay.me	privy.zay.me
zay-api-key and private key	staging pair	production pair
Network	Base Sepolia (84532)	Base (8453)
USDC contract	0x036CbD53842c5426634e7929541eC2318f3dCF7e	0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

You don't build onboarding URLs yourself: onboarding_url on a production user already points at the production host.

3. Register your production webhook endpoint

Register your production URL with the production credentials, store its new signing_secret, and confirm it with a test delivery.

4. Check your integration against the list

Before you open the integration to real users, make sure each of these is true.

Onboarding

• You pay a user only after user.onboarding_completed, to the wallet_address it carries.
• Your return page treats ?status= as a hint, never as permission to pay.
• You can send a user back to their onboarding_url if they stop halfway.

Payouts

• You send USDC on Base, from the right contract, and report the exact amount sent.
• Each report carries an Idempotency-Key you stored first, and a late retry checks List payouts before reporting again.
• You handle both payout.received and payout.expired, and reconcile pending payouts if an event is missed.

Webhooks

• Every event's signature is verified, and events are deduplicated by webhook-id.
• Your handler answers 2xx within 30 seconds and ignores unknown event types.
• You monitor your endpoint's status, so a disabled endpoint doesn't go unnoticed.

Requests

• Your servers keep their clocks in sync (NTP) — requests more than 5 minutes off are rejected.
• You retry only what Handle errors and retries says to, with backoff, and stay under 100 requests a minute per resource.
• The private key and signing secret live in a secret manager, not in code.

5. Make a first small payout

Onboard one real user — real identity verification, no sandbox toggle — send them a small amount of real USDC, and report it. Wait for payout.received before you open the integration to everyone.

Related

• Test your integration — the staging checks this page assumes
• Report a payout
• Receive and verify webhooks