Staging Environments and Separate Paystack Accounts

# .env.staging — never commit this
PAYSTACK_SECRET_KEY=sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PAYSTACK_PUBLIC_KEY=pk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NODE_ENV=staging
DATABASE_URL=postgresql://user:pass@staging-db:5432/myapp_staging

# .env.production — never commit this
PAYSTACK_SECRET_KEY=sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PAYSTACK_PUBLIC_KEY=pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NODE_ENV=production
DATABASE_URL=postgresql://user:pass@prod-db:5432/myapp

In your code, validate the environment at startup:

// startup validation
var secretKey = process.env.PAYSTACK_SECRET_KEY;
if (!secretKey) throw new Error('PAYSTACK_SECRET_KEY is not set');
if (process.env.NODE_ENV === 'production' && !secretKey.startsWith('sk_live_')) {
  throw new Error('Production environment is using a test key — deployment blocked');
}
if (process.env.NODE_ENV === 'staging' && secretKey.startsWith('sk_live_')) {
  throw new Error('Staging environment is using a live key — configuration error');
}

In the Paystack dashboard:

1. Go to Settings → API Keys & Webhooks
2. In Test mode, set Test Webhook URL to your staging webhook endpoint: https://staging.yourapp.com/webhook/paystack
3. In Live mode, set Live Webhook URL to your production webhook: https://yourapp.com/webhook/paystack

Use the same webhook handler code for both — the validation logic (HMAC check) and event processing are identical. The only difference is which secret key is used for the HMAC check (test key in staging, live key in production).

For local development where your staging URL is not publicly accessible, use ngrok:

ngrok http 3000
# Set the ngrok URL as temporary Test Webhook URL in Paystack dashboard
# Update it each time ngrok restarts (random URL)

This guide is part of the Paystack testing guide.

Sign up for the McTaba newsletter