Production onboarding

Production access is human-controlled. There is no self-serve signup, no dashboard for minting keys, and no API for granting yourself venues.

Lifecycle

request access
    → sandbox credentials + venue grants
    → you integrate against https://stage.cbms.venuesetu.com
    → certification
    → production approval
    → production credentials + venue grants
    → you cut over to https://cbms.venuesetu.com

1. Request access

Email the CBMS platform team at hello@venuesetu.com. You will need a legal/commercial relationship with the venue(s), a technical owner for the integration, and one named engineer to receive keys (handover).

2. Sandbox

We issue a sandbox API key and grant sandbox venues. You follow Getting Started and Sandbox.

3. Integrate

Implement discovery, hold → confirm, cancel, idempotent retries, and webhook verification. Stay on the sandbox host.

4. Certification

You run the certification cases and send the evidence; we confirm the result in writing. Do not skip this and point live customers at production.

5. Production approval

We agree which production venues your partner identity may book. Grants are per environment. A sandbox grant does not apply on production.

We also confirm that production runs a release that includes the behaviour you built against on the sandbox (see Sandbox and production differences). Your production access is not enabled before that.

6. Production credentials

We issue a new API key for production and hand it to your named engineer through a one-time secret link, the same way as the sandbox key. Store it separately from the sandbox key. Configure:

https://cbms.venuesetu.com/api/v1

Subscribe webhooks again on this host (new secret_key). Confirm GET /health returns "sandbox": false.

7. Cutover

Switch your live checkout to the production base URL and production key. Keep sandbox for ongoing QA.

If a production key stops working (401), email hello@venuesetu.com. Revoked and unknown keys look the same on purpose.

What we will not do here

We will not publish admin routes, operator runbooks, or a form that mints keys. If you need a rotation, a new venue grant, or a higher rate limit, email hello@venuesetu.com.