Skip to main content

Test before you go live

Everything in Licet that moves money or issues licences can be exercised before a real customer touches it. This guide walks the rehearsal, then the go-live checklist.

Rehearse the purchase flow​

  1. Create a test checkout from Payments → Checkout & paywall in the portal. The button runs the exact checkout-sessions call your app will make (with a throwaway customer reference) and hands you the Stripe URL.
  2. Pay with a test card — if your connected Stripe account is in test mode, 4242 4242 4242 4242 with any future expiry and CVC completes the payment without money moving.
  3. Watch the licence arrive. Within moments the completed session should produce a licence.created delivery under Payments → Webhook deliveries, and the licence itself appears in your licences list.

If step 3 is where it breaks, that's the point of rehearsing — fix the webhook handler while the stakes are zero.

Prove your webhook handler​

  • Send test event (on the deliveries page) fires a real, signed webhook.test event with data.object = { "ping": true } through the normal delivery pipeline. It proves your endpoint is reachable, your signature verification works, and you return a 2xx inside the 5-second timeout.
  • Deliberately fail once. Return a 500, watch the delivery show as failing, then fix it and hit Replay. Now you know what an incident looks like before you're in one.
  • Registering separate endpoints for your staging and production receivers? Mark them with the test/live mode selector so they're distinguishable in the list — and disable staging endpoints when you're done with them, since enabled endpoints receive the events they're subscribed to.

Exercise your product's licence checks​

While developing, the SDK stays out of your way by design:

  • The background heartbeat is skipped in development environments.
  • Domain restrictions allow localhost, 127.0.0.1, and common staging patterns (dev-*, *.local, *.test, azurewebsites.net…) by default.

So to see real behaviour, run a production-configuration build and check: your feature gates respond to Has/Limit, an expired or missing token degrades the way you intend (nag vs lock), and OnInvalid does something sensible.

Then rehearse the ugly one: revoke your test licence from the portal and confirm the install notices and degrades gracefully. Better you discover that behaviour than a refunded customer.

Go-live checklist​

  • Stripe connected and charges enabled on the live account.
  • Plans priced — every sellable plan has a price mapping.
  • API keys per system, minimal scopes — the checkout backend gets issue, the back-office dashboard gets read; nothing gets admin that doesn't administer. Secrets are in a vault, not in source.
  • Production webhook endpoint registered, its whsec_ secret deployed, test-send passing, and your handler idempotent (dedupe on event.id).
  • Fulfilment driven by licence.created, not by the success page — the success URL is a thank-you, not proof of payment.
  • JWKS shipped with your product (licet-jwks.json), not fetched at install time.
  • Spend cap set under Account → Spend cap if you want a monthly budget on transaction fees — remember reaching it pauses new checkouts.
  • A revocation rehearsed end-to-end, so you know what your customers would see.