Before collecting real money

Use this list when enabling a business or switching from Test to Live. A local test or a screen that opens without errors does not confirm acquirer enablement or the fiscal authorization to invoice in Live mode.

Setup and credentials

• You enabled only what you need: Collect, Invoicing, or both.
• You configured each mode separately. Test keys are not used in Live mode.
• API keys, webhook secrets, and certificates stay on the server.
• For Checkout, your merchant account is connected Live in Portal Timbro: Azul accepted your live credentials, or the Timbro team connected your CardNet or Portal merchant account.
• To issue e-CF in Live mode, you completed fiscal setup and confirmed the authorization that applies to the issuer.

Payments

• A test payment completed, and your server retrieved the same Payment. You mark the order paid only when its status is succeeded.
• You check the reference, currency, and amount before applying the payment to the order.
• If a response is lost, you retry with the same paymentReference and data, then retrieve the same payment.
• Your team knows how to handle verifying: wait and recover the same payment without starting another payment.

Invoices and notifications

• If you issue e-CF, you completed a test issuance and retrieved the same invoice by invoiceId or invoiceReference.
• Your system retrieves the invoice separately from the payment. Payment.status: "succeeded" does not confirm fiscal acceptance or XML/PDF readiness.
• You wait for each file’s status to become ready before downloading it.
• Your webhook receiver verifies the signature, deduplicates by event.id, and retrieves the Payment or Invoice identified by event.data.id.
• Your team knows how to escalate an Invoice that requires intervention (operatorRequired).
• If your system sends invoices from a queue, it looks up the invoiceReference before issuing again, so the same sale is never issued twice.
• Only one system emails the invoice to the buyer: Timbro or your system.
• Before offering an e-CF type in Live mode, you check in GET /v1/business that it is ready.

Support

• You retain the IDs, mode, Request-Id, and error codes needed to investigate a failure.
• You do not log keys, tokens, card data, full XML/PDF files, or private links.
• Someone reviews payments with an unconfirmed result and invoices that require intervention.

Check enabled capabilities and error handling before going Live.