Deployment
Once the integration has been verified end-to-end in the sandbox (see Testing), follow this checklist to go live.
Production CDN
Swap the script source from the test bundle to the production bundle:
<!-- Sandbox -->
<script src='https://test-pay.dnapayments.com/components/apple-pay/apple-pay-component.js'></script>
<!-- Production -->
<script src='https://pay.dnapayments.com/components/apple-pay/apple-pay-component.js'></script>
The bundle determines the default environment, so the environment field in init() can be omitted in production. Pass it explicitly only if you need to override.
Go-live checklist
| # | Step | Where |
|---|---|---|
| 1 | Production-domain registered in Settings → Online payment methods → Apple Pay → Add new domain | portal.dnapayments.com |
| 2 | Backend uses production clientId, clientSecret and terminalId, and requests tokens from https://oauth.dnapayments.com/oauth2/token (instead of the test-oauth URL) | Your backend |
| 3 | <script> tag points at https://pay.dnapayments.com/components/apple-pay/apple-pay-component.js | Your HTML |
| 4 | if (await DNAPayments.ApplePayComponent.isAvailable()) gate is in place | Your front-end code |
| 5 | payload (with requiredShippingContactFields and shippingMethods) is passed to init() | Your front-end code |
| 6 | Content-Security-Policy allows applepay.cdn-apple.com and pay.dnapayments.com | Your CSP headers |
| 7 | Smoke-test a small live transaction end-to-end (including a shipping address change inside the sheet) and reconcile in the portal | Browser + portal |
Domain match
Production domains must match window.location.hostname exactly: no www. mismatch, no wildcards. Each subdomain that hosts the button has to be added separately. If the user opens the page from a host that is not registered in the production portal, the button renders normally but the merchant validation step (triggered after the user taps it) fails with 1003 FAILED_TO_VALIDATE_APPLE_PAY_SESSION in onError.