Record each environment difference
Stripe separates sandbox and live keys. That separation does not prove all test and live behaviours are identical. This worksheet concerns an actual release decision; fill it from the target’s documentation and observed tests rather than assuming parity.
| Concern | Sandbox evidence | Production preparation |
|---|---|---|
| Credential scope | Test-only account and permissions | Verify live account/least privilege separately |
| Webhook signing | Synthetic events verified | Correct live endpoint secret reference |
| Quota and delays | Small controlled workload | Document real constraints; bounded release |
| Recovery | Replay tested on synthetic identities | Keep live reconciliation and stop decision ready |
Verify a limited authorised live path
Choose a safe live verification task with its owner, expected result and cleanup/reconciliation plan. Some provider actions require separate approvals or cannot be simulated fully. Keep those as unresolved prerequisites; do not claim production readiness from sandbox success alone.
The sandbox used the correct secret. Can it be reused for the live webhook endpoint?
Show the worked answer
No. Resolve the live endpoint’s own configured signing reference and verify that path. Keep environment secrets separated and record which endpoint was actually tested.