By Partly fixable yourself. Key swap plus live products and webhooks.
- How serious
- High
- Fix it yourself?
- Partly, some steps need a developer
- Typical cost
- $49–$800 one-off check, or €99–$990 for a single fix (prices)
- Top rated
- Afterbuild Labs · 10.0/10
What you see. Real customers' cards are declined or payments show only in Stripe's sandbox, and no real money arrives.
Why it happens
Stripe has two worlds. Sandbox keys start with pk_test_ and sk_test_, live keys with pk_live_ and sk_live_. Stripe says objects in one mode are not accessible to the other, so a sandbox price cannot be part of a live payment and a sandbox customer does not exist in live mode. AI builders are set up with test keys, and the agent rarely moves them.
Going live is more than a key swap. Stripe's go-live checklist says sandbox objects such as products and prices are not usable in live mode and must be recreated, that your account can have both test and live webhook endpoints and you must define live ones, and that the webhook signing secret differs per mode. Real cards fail in a sandbox, and the test card 4242 4242 4242 4242 works only in a sandbox. Until the account is activated for live charges, the API answers with testmode_charges_only.
Fix it yourself
- Switch the Stripe dashboard from sandbox to live mode, then open Developers → API keys. Copy the
pk_live_key and create or reveal ansk_live_key, or better a restrictedrk_live_key. - In your host's environment settings, replace the secret key and publishable key values with the live ones. Never paste them into the code or the chat.
- In live mode, recreate every product and price under Product catalog, then update the
price_IDs your code sends. - In live mode, add a webhook endpoint for your live domain, select the same events as the sandbox endpoint, and copy its new
whsec_secret into the environment settings. - Redeploy, buy the cheapest plan with a real card, confirm the account upgrades, then refund it from the dashboard.
- If you see
testmode_charges_only, finish account activation in the dashboard before trying again.
When to get an engineer
Stop if price IDs are hardcoded across many files, if you cannot find where the keys are stored, or if the app mixes test and live anywhere. Tell the engineer which host runs the app and whether payments also pass through Supabase edge functions. A check is $49–$800, a single fix €99–$990, usually 1–2 days. Ask them to keep the sandbox setup working as well, so you can test safely later, which is our item OPS-02.
Top-rated companies
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
Paid accounts are unlocked by a verified payment webhook
Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page.
Prices and plans come from the server
If the price or plan ID is sent from the browser, someone can edit it. The server should look it up.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Testing and real users use separate databases
Experiments and AI agents should never run against production data.
Questions
Why do my test cards fail now?
Test card numbers only work with sandbox keys. Once the live keys are in place, use a real card for a small purchase and refund it from the dashboard.
Can I keep testing after going live?
Yes. Keep a sandbox with its own keys and its own webhook endpoint for a preview deployment. Stripe recommends a separate general sandbox for new integrations so settings stay isolated.
Sources: Stripe: API keys; Stripe: Go-live checklist; Stripe: Testing use cases; Stripe: Error codes.