Production onboarding

Production access is human-controlled. There is no self-serve signup, no dashboard for minting keys, and no API for granting yourself venues.

Lifecycle

request access
    → sandbox credentials + venue grants
    → you integrate against https://stage.cbms.venuesetu.com
    → certification
    → production approval
    → production credentials + venue grants
    → you cut over to https://cbms.venuesetu.com

1. Request access

Contact the CBMS platform team. You will need a legal/commercial relationship with the venue(s) and a technical owner for the integration.

2. Sandbox

We issue a sandbox API key and grant sandbox venues. You follow Getting Started and Sandbox.

3. Integrate

Implement discovery, hold → confirm, cancel, idempotent retries, and webhook verification. Stay on the sandbox host.

4. Certification

We confirm the certification behaviours. Do not skip this and point live customers at production.

5. Production approval

We agree which production venues your partner identity may book. Grants are per environment. A sandbox grant does not apply on production.

6. Production credentials

We issue a new API key for production. Store it separately from the sandbox key. Configure:

https://cbms.venuesetu.com/api/v1

Subscribe webhooks again on this host (new secret_key). Confirm GET /health returns "sandbox": false.

7. Cutover

Switch your live checkout to the production base URL and production key. Keep sandbox for ongoing QA.

If a production key stops working (401), contact us. Revoked and unknown keys look the same on purpose.

What we will not do here

We will not publish admin routes, operator runbooks, or a form that mints keys. If you need a rotation, a new venue grant, or a higher rate limit, ask the platform team.