> This page is for version 🇦🇺 AU (default).
> For other versions, use one of these documentation indexes:
> - 🇦🇺 AU (default): https://docs.humanapproved.com/au/llms.txt
> - 🇬🇧 UK: https://docs.humanapproved.com/uk/llms.txt
> - 🇺🇸 US: https://docs.humanapproved.com/us/llms.txt

> This is HumanApproved's documentation, as Markdown for AI agents. /llms.txt lists every page; /llms-full.txt has them all. If you're helping someone integrate HumanApproved, start with /guides/ai-coding-agents.

# Test and go live

> How to test a HumanApproved integration with test keys and websites, trigger a test review, go live and troubleshoot common errors.

## Test keys and test websites

Test and live are separate environments on the same host, `https://au.humanapproved.com`.

|                  | Test                                                                               | Live                             |
| ---------------- | ---------------------------------------------------------------------------------- | -------------------------------- |
| Publishable key  | `pk_test_…`                                                                        | `pk_live_…`                      |
| Secret key       | `sk_test_…`                                                                        | `sk_live_…`                      |
| Allowed websites | Your test websites: a local development address on any port, or an `https` address | Your live websites, `https` only |
| Approval code    | Not texted: the approval page shows the code to enter                              | Texted to the customer's mobile  |

* Each key works only from the allowed websites for its environment. Add each address exactly, with scheme, host and port: there are no wildcards.
* Test reviews are separate from live ones. Only a test secret key reads a test review, and a live secret key reads only live ones.
* Checks validate quotes against the product's **published** version, so publish before you test.

See [Keys and environments](/au/concepts/keys-and-environments).

## Trigger a test review

To show the pause panel without an AI agent:

* **Set the product to Every purchase.** On the product's **Approval settings** page, set **When to ask for approval** to **Every purchase** and publish. Every check then asks for approval. Set it back before you go live.
* **Use an automated browser.** A browser driven by a tool such as Playwright is treated as an agent.

With a test key, the approval page shows the code, so you can approve or decline yourself.

## Test checklist

* [ ] With the product on **Only when an agent is detected**, a normal visit goes straight through, and the check appears under **Checks** in the portal.
* [ ] With **Every purchase** on, the step pauses and the panel shows a link.
* [ ] The link shows your quote as the customer will see it, with every value right.
* [ ] Entering the code and approving lets the paused checkout proceed.
* [ ] Declining tells the agent to ask the customer what they want to do.
* [ ] The review is under **Approvals** in the portal, with the quote that was sent.
* [ ] Your server reads the review with your test secret key and refuses to bind unless it's approved for that quote.

## Go-live checklist

* [ ] **Live key.** Replace the test publishable key with your live key, `pk_live_…`, and your server's secret key with `sk_live_…`, from environment variables or your secrets manager.
* [ ] **Live websites.** Add your production checkout's address to the product's live allowed websites (`https` only).
* [ ] **Published version.** The product has a published version with the right fields, wording and **When to ask for approval** setting: usually **Only when an agent is detected**, or **Never — monitor only** to measure agent traffic first. See [Monitor only](/au/guides/monitor-only).
* [ ] **Content Security Policy.** Your production policy allows `https://cdn.beopen.com` in `script-src` and your region's address in `connect-src` (and `img-src` for a logo). See [Content Security Policy](/au/guides/content-security-policy).
* [ ] **Pinned script.** The embed is loaded on every page of the journey, with the version and `integrity` hash from the portal's **Embed** page.
* [ ] **Server verification.** Your server checks the review before it binds: status `approved`, matching `quoteRef`, `env` is `live`. See [Verify on your server](/au/guides/verify-on-your-server).
* [ ] **Bot check.** If agents might open the approval link themselves, the product's **bot check** is on in its **Approval settings**: it's off by default. See [Bot check](/au/concepts/approval-methods#bot-check).
* [ ] **Fail-open considered.** The embed lets the step proceed when HumanApproved doesn't respond in time or anything goes wrong. Decide what your server does with a purchase that has no approved review, and in a server or agent flow whether to retry rather than proceed.
* [ ] **Privacy notice.** Your privacy notice and cookie policy name the checks, as you would fraud prevention.

## Troubleshooting

When something goes wrong, the embed lets the step proceed and writes a warning to the browser console. A refused key or website gets a response without CORS headers, so the browser console shows no response: find the status and code on the request to `/api/v1/checks` in the browser's network panel.

| You see                                                                                  | Why, and what to do                                                                                                                                                                                                                                                     |
| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `403 origin_not_allowed`                                                                 | The page's address isn't an allowed website for the key's environment. Scheme, host and port must match exactly. Add it to the product's test or live websites. From a server, send an allowed `Origin` header.                                                         |
| `409 product_not_live`                                                                   | The key's product has no published version. Publish it, or check the key belongs to the product you expect.                                                                                                                                                             |
| `401 invalid_key`                                                                        | The key is mistyped, cut short, revoked, the wrong kind (a secret key where a publishable key goes, or the other way round) or from another region. Use the full key you copied when it was created, or create a new one.                                               |
| `422 invalid_quote`                                                                      | A required quote field is missing or the wrong type, or the mobile isn't a valid mobile number. The error's `fields` lists each one: compare `quoteDetails` with the product's published fields.                                                                        |
| The browser refuses a request to your region's address or a script from `cdn.beopen.com` | Your Content Security Policy blocks it. Add the source: see [Content Security Policy](/au/guides/content-security-policy).                                                                                                                                                 |
| Failed to find a valid digest in the `integrity` attribute                               | The version and hash in the script tag don't match. Copy them together from the **Embed** page.                                                                                                                                                                         |
| Nothing happens on click: the step never pauses                                          | Make sure `before` matches the right element and `protect` runs from a file, not an inline script. Also make sure the product isn't set to **Never — monitor only**, and checks appear under **Checks**. To see the pause panel, set the product to **Every purchase**. |