# 🏦 Midtrans Production Setup Guide

## 🚨 **Key Differences: Sandbox vs Production**

| Aspect | Sandbox | Production |
|--------|---------|------------|
| **Money** | 💰 Fake money | 💸 **REAL MONEY** |
| **Dashboard** | `dashboard.sandbox.midtrans.com` | `dashboard.midtrans.com` |
| **Credentials** | `SB-Mid-client-xxx` | `Mid-client-xxx` |
| **Verification** | None required | **Business verification required** |
| **Webhooks** | Local testing OK | **Must be publicly accessible** |
| **Cards** | Test cards only | Real credit/debit cards |
| **Regulations** | None | **Bank regulations apply** |

---

## 📋 **Prerequisites for Production**

### **1. Business Verification** ⚠️
- **Company registration** documents
- **Bank account** verification  
- **Tax ID** (NPWP in Indonesia)
- **Business license** documents
- **Identity verification** of business owner

### **2. Midtrans Account Approval**
- Complete business verification process
- Wait for Midtrans approval (can take 1-7 business days)
- Get production credentials

---

## 🔧 **Step 1: Get Production Credentials**

### **Apply for Production:**
1. Go to https://dashboard.midtrans.com/ 
2. **Register business account** (not personal)
3. **Submit required documents**:
   - Business registration (Akta Pendirian)
   - Tax ID (NPWP)
   - Bank account statement
   - Business license
4. **Wait for approval** from Midtrans team
5. **Get production credentials** after approval

---

## 🔧 **Step 2: Environment Configuration**

### **Update your `.env` file:**

```env
# Midtrans Production Configuration
MIDTRANS_CLIENT_KEY=Mid-client-your_production_client_key_here
MIDTRANS_SERVER_KEY=Mid-server-your_production_server_key_here
MIDTRANS_IS_PRODUCTION=true  # ⚠️ IMPORTANT: Set to true
```

### **Key Differences:**
- Credentials **don't have "SB-"** prefix
- `MIDTRANS_IS_PRODUCTION=true` (very important!)
- Use **production dashboard** to get keys

---

## 🔧 **Step 3: Code Changes** 

**Good news: NO CODE CHANGES needed!** 🎉

The PaymentController automatically switches based on `MIDTRANS_IS_PRODUCTION` setting in your config.

### **Verify Configuration:**
```php
// Check your config/services.php
'midtrans' => [
    'client_key' => env('MIDTRANS_CLIENT_KEY'),
    'server_key' => env('MIDTRANS_SERVER_KEY'),
    'is_production' => env('MIDTRANS_IS_PRODUCTION', false), // ✅ This handles the switch
    'sanitize' => true,
    '3ds' => true,
],
```

---

## 🌐 **Step 4: Webhook Setup** 

### **Production Webhook Requirements:**

#### **Problem: Local Development**
```bash
# ❌ This won't work in production:
http://localhost:8000/api/midtrans-notification
```

#### **Solution: Public Domain**
```bash
# ✅ Use real domain:
https://yourdomain.com/api/midtrans-notification

# ✅ Or staging subdomain:
https://staging.yourdomain.com/api/midtrans-notification
```

### **Configure Webhook URL:**
1. Go to **Production Dashboard** → **Settings** → **Configuration**
2. Set **Payment Notification URL**: `https://yourdomain.com/api/midtrans-notification`
3. Set **Finish/Unfinish/Error URLs** as needed

### **For Local Testing with Production:**
Use **ngrok** or similar tunneling service:

```bash
# Install ngrok
npm install -g ngrok

# Expose local server
ngrok http 8000

# Use the https URL provided by ngrok
# Example: https://abc123.ngrok.io/api/midtrans-notification
```

---

## 💳 **Step 5: Payment Testing**

### **Test Cards vs Real Cards:**

| Environment | Cards Accepted |
|-------------|----------------|
| **Sandbox** | Test cards only (`4811 1111 1111 1114`) |
| **Production** | **Real credit/debit cards only** |

### **Production Testing Strategy:**
1. **Start with small amounts** (Rp 1,000 - Rp 10,000)
2. **Use your own cards** for initial testing
3. **Refund test transactions** immediately
4. **Monitor Midtrans dashboard** for all transactions

---

## 🔒 **Step 6: Security Considerations**

### **Enhanced Security for Production:**

1. **Environment Variables:**
   ```bash
   # ⚠️ NEVER commit production keys to version control
   # Use secure environment management
   ```

2. **Server Security:**
   ```bash
   # Use HTTPS only
   # Secure server configuration  
   # Regular security updates
   ```

3. **Webhook Security:**
   ```php
   // ✅ Signature verification is already implemented
   // in PaymentController->handleNotification()
   ```

4. **Rate Limiting:**
   ```php
   // Consider adding rate limiting to payment endpoints
   Route::middleware('throttle:10,1')->group(function () {
       Route::post('/payments/initiate', [PaymentController::class, 'initiatePayment']);
   });
   ```

---

## 📊 **Step 7: Monitoring & Management**

### **Production Dashboard:**
- **URL**: https://dashboard.midtrans.com/
- **Transaction monitoring**
- **Settlement reports**  
- **Refund management**
- **Fraud detection alerts**

### **Important Monitoring:**
- **Daily transaction reports**
- **Failed payment alerts**
- **Webhook delivery status**
- **Settlement schedules**

---

## 💰 **Step 8: Financial Considerations**

### **Transaction Fees:**
- **Credit Card**: ~2.9% + Rp 2,000
- **Bank Transfer**: ~Rp 4,000 - Rp 5,000  
- **E-Wallet**: ~0.7% - 2%
- **Convenience Store**: ~Rp 2,500

### **Settlement:**
- **T+1 to T+7** business days (depends on payment method)
- **Bank fees** may apply
- **Tax obligations** for business transactions

---

## 🚨 **Step 9: Go-Live Checklist**

### **Before Going Live:**

- [ ] **Business verification** completed and approved
- [ ] **Production credentials** obtained
- [ ] **Environment variables** updated to production
- [ ] **Domain SSL certificate** installed  
- [ ] **Webhook URL** configured in Midtrans dashboard
- [ ] **Payment flow** tested with small amounts
- [ ] **Error handling** tested (failed payments, timeouts)
- [ ] **Refund process** tested
- [ ] **Monitoring systems** in place
- [ ] **Customer support** process defined
- [ ] **Legal compliance** reviewed (PCI DSS, local regulations)

### **Post Go-Live:**

- [ ] **Monitor first transactions** closely
- [ ] **Test customer support** flow
- [ ] **Verify settlement** timing
- [ ] **Monitor webhook delivery**
- [ ] **Regular security audits**

---

## 🆘 **Production Troubleshooting**

### **Common Production Issues:**

1. **"Invalid credentials" error:**
   - Verify production keys don't have `SB-` prefix
   - Check `MIDTRANS_IS_PRODUCTION=true`
   - Clear config cache: `php artisan config:cache`

2. **Webhook not received:**
   - Check public accessibility of webhook URL
   - Verify HTTPS certificate
   - Monitor Midtrans dashboard webhook logs

3. **Payment fails immediately:**
   - Check if using test cards in production
   - Verify payment amount meets minimum requirements
   - Check payment method availability in production

4. **Settlement delays:**
   - Normal for production (T+1 to T+7 days)
   - Check bank holiday schedules
   - Contact Midtrans support if unusual delays

---

## 📞 **Support & Resources**

### **Midtrans Production Support:**
- **Email**: support@midtrans.com
- **Phone**: +62 21 2927 1500
- **Business Hours**: Monday-Friday, 9 AM - 6 PM WIB

### **Documentation:**
- **Production API**: https://docs.midtrans.com/
- **Business Registration**: https://midtrans.com/business-registration
- **Compliance Guide**: https://docs.midtrans.com/en/other/compliance

---

## ⚡ **Quick Migration Summary**

```bash
# 1. Get production credentials (after business verification)
MIDTRANS_CLIENT_KEY=Mid-client-production-key
MIDTRANS_SERVER_KEY=Mid-server-production-key  
MIDTRANS_IS_PRODUCTION=true

# 2. Setup public webhook URL
# 3. Test with small amounts
# 4. Monitor dashboard
# 5. Ready for real customers! 🎉
```

---

## ⚠️ **Important Reminders**

- 🚨 **Real money** involved - test thoroughly
- 🔒 **Security** is critical - use HTTPS
- 📋 **Compliance** - follow local regulations  
- 💬 **Support** - have customer service ready
- 📊 **Monitoring** - watch transactions closely
- 🏦 **Settlements** - expect T+1 to T+7 days

**Production is exciting but requires responsibility!** 🚀💼