Live keys
Production should use live Stripe keys. Test keys may remain only for a short controlled test and must be turned off after verification.
- STRIPE_SECRET_KEY starts with sk_live_ for real launch.
- Webhook endpoint is created in Stripe Dashboard and points to /api/stripe/webhook.
- Success and cancel URLs point to OmenHall domain, not preview.