Going live

How to get live keys

1. Work through the whole checklist in the sandbox.
2. The developer dashboard records most items automatically as you test.
3. Run the automated certification test from the dashboard. It checks a link, a published menu, a full order to completed, and a webhook event that reached your endpoint.
4. Once the test passes, our team reviews your account and approves it.
5. Once approved, live keys pk_live_xxx and sk_live_xxx are issued.

Before certification the live address answers 403 PARTNER_NOT_CERTIFIED.

Your account status

At launch we create partner accounts ourselves. Then self-registration opens in the developer dashboard: your account starts as pending, and the sandbox works right away.

When you sign up you accept the partner terms, and we keep the terms version and the time you accepted. If the terms change, we ask you to accept again.

The API is free during the beta, with usage limits. Pricing will be announced later.

Certification checklist

Signing and security

• A correct request succeeds.
• A wrong signature, an old timestamp and a reused nonce are each refused, and your system logs the error code.
• Secrets live on your server only, never in an app, a browser or a log.
• Your servers’ clocks run NTP.
• Your webhook endpoint is public https, and so is your quote URL if you have one.
• You ask for customer:contact only if you need the full number, and your system works with the masked one.

Idempotency

• Repeating a PUT with the same key returns Idempotent-Replayed: true.
• Retries take a new signature and the same key.

Linking

• Your system shows the code as text and as a QR.
• It handles link.created.
• After link.removed, every call for that place stops.

Menu

• Publishing a full CM v1 menu succeeds.
• A patch with an old version is handled: read, then publish again.
• An item sold out at the merchant reaches AurMap within 5 seconds.
• State updates send the full sold-out list, not only the new item.
• A menu.changed made by the merchant is mirrored in your system.
• The nightly reconcile with POST /menus/reconcile runs.

Events

• The signature is checked in constant time.
• Messages older than 5 minutes are rejected.
• Duplicate events are ignored by event_id.
• Unknown types and fields are ignored.
• The 200 answer comes within 10 seconds.

Orders

• An order is accepted before accept_by.
• A rejection with a reason.
• The full path to completed.
• A merchant cancel after acceptance.
• order.cancelled with reasons customer and timeout removes the order from the kitchen screen.
• A cash order completes at pickup.

Recovery

• After 10 minutes with your endpoint down, your system recovers waiting orders from GET /orders?status=received or the events log.
• A 429 is retried after Retry-After.

Operations

• A support e-mail for your team, and a way to reach you during incidents.

For accounting systems Coming soon

• A closed day matches the payout.
• Corrections land on the right day.

Launch day

1. Add the live keys and the live address to your server.
2. Register a live webhook endpoint and save its secret.
3. Press “send test” in the dashboard and confirm it arrived.
4. Link one branch of a real merchant first, and follow its first order.
5. Then open linking to all your merchants.