Live base URL:
https://api.ledgersyncappv2.com/v3 ·
Key prefix: sk_live_.... Sandbox keys (sk_test_...) do not
authenticate against the live base URL, and vice-versa.Before your first live user
Mint a live API key
Same flow as sandbox, but choose live as the environment. Copy the
sk_live_... value once, it’s shown only at creation, and store it in your
server’s secret store. See Authentication.Store the signing secret somewhere durable
The
signing_secret from your webhook subscription is shown exactly
once. Persist it to a real secrets manager (GCP Secret Manager, AWS
Secrets Manager, 1Password Connect, whatever you already run) before you
close the tab. You need it to verify every delivery.Dedupe on event_id
We retry failed deliveries with exponential backoff for 24 hours, so
the same event can land more than once. Keep a short-lived set of seen
event_ids and short-circuit duplicates. Your handler must be idempotent.Return 2xx fast
Acknowledge each delivery within 30 seconds. If your work is slow (DB
writes, notifications, downstream calls), enqueue it and return
200
immediately, anything else looks like a failure and triggers a retry.Verify signatures constant-time
Compare the HMAC with
hmac.compare_digest (Python) /
crypto.timingSafeEqual (Node) / your language’s equivalent, never a plain
==, which leaks timing. Reject any delivery whose
X-LS-Webhook-Timestamp is more than 5 minutes old. Full recipe in
Webhooks.Exercise your handler with webhook.test
Fire
POST /v3/webhooks/subscriptions/{id}/test any time. It’s signed with
the subscription’s real signing_secret and carries the same headers as
production, so your verification path runs end-to-end. It bypasses the
event_types filter, so you don’t need to subscribe to webhook.test for
it to land.Plan for connection.failed and connection.disconnected
Banks reject credentials, MFA tokens expire, users revoke access. Subscribe
to both events and surface a clear re-link call to action in your UI
when either fires. See Connection lifecycle.
What changes from sandbox
| Sandbox | Live | |
|---|---|---|
| Base URL | api-sandbox.ledgersyncappv2.com/v3 | api.ledgersyncappv2.com/v3 |
| Key prefix | sk_test_... | sk_live_... |
| Banks | Aggregator sandbox banks + FDE Ledgersync Bank | Real financial institutions |
| Everything else | — | Identical |
Same endpoints, same webhook shapes, same routing. If it worked against the
FinBank smoke test, it works live.