Skip to content

Go-live checklist

Everything to check before your ShowTix integration goes live — keys, scopes, IP allowlists, webhook security, rate limits and monitoring.

For developersLast updated

On this page

Work through this list before your integration handles real customers and real money.

Keys#

  • Switch from your test key to a live key. Create a stx_live_ key in Developers and deploy it to production only. Test keys never hold tickets or fire webhooks — a live checkout won't work on one.

  • Use least-privilege scopes. Grant only what the integration calls — a read-only events listing needs just events:read. See the scopes table.

  • Lock the key to your servers' IPs. Add your egress IPs or CIDR ranges to the key's allowlist.

  • Keep the key server-side. In environment variables or a secrets manager, never in front-end code or a mobile app. In the browser, use the embeddable checkout.

Webhooks#

  • Use a live HTTPS endpoint. With a valid TLS certificate, and set to Live mode — test endpoints never receive real events.

  • Verify every signature. Check ShowTix-Signature against the raw body, accept any matching v1 and reject timestamps more than 300 seconds old — see verifying signatures.

  • Return 2xx fast. Acknowledge within 10 seconds and do the slow work in a background job.

  • Process idempotently. Deduplicate on ShowTix-Event-Id and don't assume delivery order.

Resilience#

  • Handle 429 with backoff. Watch RateLimit-Remaining, and on 429 wait Retry-After seconds before retrying — see rate limits.

  • Send Idempotency-Key on writes. So a retried checkout session or comp batch never runs twice — see idempotency.

  • Store the ticket id, not the barcode. Barcodes rotate on transfer; id never changes.

  • Ignore unknown fields and event types. We add them without notice — see the versioning policy.

  • Log Request-Id. Every response has one; include it when you contact support.

Operations#

  • Monitor in the Developers dashboard. Watch request volume, error rates, key usage and webhook delivery health in Developers (see the dashboard guide), and make sure your owners and admins receive the endpoint-disabled email.

  • Rotate keys when staff change. Roll keys (with a grace period) whenever someone with access leaves, and revoke anything unused — see rotation.

  • Tell us you're live. Email support@showtix.com.au with your organisation and use case — we can review your integration and raise rate limits for big on-sales.

All set? Switch your production environment to the live key and watch the first orders arrive in Developers.

Was this article helpful?

Related articles