|
| 1 | +--- |
| 2 | +title: Deploy a Production Version on Mainnet |
| 3 | +order: 40 |
| 4 | +--- |
| 5 | + |
| 6 | +import { Alert } from "@site/src/components/Alert"; |
| 7 | + |
| 8 | +Once the test server is live and you have tested the payment flow with a **SA**, it's time to deploy a productionized version of the test server on mainnet. |
| 9 | + |
| 10 | +The **RA** server code deployed to each environment should be the same, and additional functionality offered in production should be enabled via environment variables. This is called _code parity_, which significantly reduces operational and deployment complexity. It also allows **RA**s to use the Testnet service as a staging environment for debugging or new features and allows the **SA**s to test their client code before integrating with the **RA**'s mainnet service. |
| 11 | + |
| 12 | +## Deploying a Secure Environment |
| 13 | + |
| 14 | +Make sure to keep the test server up, and deploy the production (mainnet) system in a separate environment. Having two deployments allows you to validate new features on the testnet before deploying to production. |
| 15 | + |
| 16 | +To switch to Stellar's public (mainnet) network, all you have to do is change the network [passphrase](../../glossary/network-passphrase.mdx) (for authenticating requests) and the [Horizon URL](https://horizon.stellar.org/). Stellar SDKs have all the built-in logic to switch from test to public with minor changes to the codebase. |
| 17 | + |
| 18 | +If you're issuing your own asset in addition of offering an on/off ramp, make sure you follow [best practices for asset issuance](../../issuing-assets/how-to-issue-an-asset.mdx) by creating a distribution account that is separate from the issuing account before distributing real assets on the public network. The issuing account secret key should be highly secured via means such as cold storage or multi-signature, and should only be used to send (and, consequently, issue) assets to the distribution account. The distribution account will be used by the **RA** server to receive assets from other accounts programmatically. |
| 19 | + |
| 20 | +Since the distribution account will be managed programmatically, it should only have a balance necessary to keep operations running for a short period of time. The issuing account should send small amounts of an asset to the distribution account frequently to represent the expected deposit volume for a given period. You should set up the transfer from the issuing account to the distribution account once day (or once a week week) to make sure the distribution account only has the minimum necessary balance to keep the operation functional in that short period. |
| 21 | + |
| 22 | +## Validating Real KYC |
| 23 | + |
| 24 | +Most anchors need to collect [Know Your Customer](https://en.wikipedia.org/wiki/Know_your_customer) information to comply with local regulations before honoring payments. In SEP-31, the **SA** controls the UX for the **SU**. Typically, the **SA** will offer an online or in-app UX, but physical remittance locations are also acceptable. Its also important for **SA**s to be able to contact **SU**s when information must be updated or when the transaction succeeded. |
| 25 | + |
| 26 | +How the **RA** complies with their local regulations by validating KYC information is up the **RA**: there are many services that provide KYC solutions through APIs that validate the input data against governmental databases to verify requirements. Each jurisdiction has specific KYC requirements, and they differ from jurisdiction to jurisdiction, so it's best to find a country-specific KYC provider that meets your needs. Many **RA** organizations can validiate the KYC data collected without using a third-party service. |
| 27 | + |
| 28 | +Some countries require different KYC fields depending on the payment amount. If that's the case in an **RA**'s jurisdiction, the **RA** needs to expect and support different KYC `type` values in `GET /customer` requests. Only one `type` value can be specified in the `/info` response per-customer, so a different large-payment `type` value will have to be documented and communicated to the **RA**'s partner **SA**s outside the SEP. |
| 29 | + |
| 30 | +KYC information should be linked to the `id` returned by the `PUT /customer` calls, so you only need to ask the **SU** for it once as long as the data provided is valid. |
| 31 | + |
| 32 | +<Alert> |
| 33 | + |
| 34 | +Note: The SDF encourages anchors to have the same KYC collection process on the Testnet server and Mainnet server. However, _validation_ of KYC data on Testnet is unnecessary and prevents third parties from testing your service. KYC validation should only be supported on Mainnet unless the field uses a well-known format like email addresses. |
| 35 | + |
| 36 | +</Alert> |
| 37 | + |
| 38 | +## Connecting to Real Banking Rails |
| 39 | + |
| 40 | +Fiat-backed token anchors are expected to manage a full reserve. That means there's a 1:1 relationship between Stellar-network tokens and money in the bank. Since each fiat token on Stellar is backed by, and can be redeemed for, an underlying, real-world asset, anchors of fiat-backed tokens need to connect to real banking rails to make payments to receiving users (generally through bank transfers). This applies to both issuing and non-issuing anchors. |
| 41 | + |
| 42 | +Once Stellar payment transactions have been detected and matched to an internal transaction record using the memo of the payment, **RA**s must attempt the off-chain payment (typically using a bank transfer). |
| 43 | + |
| 44 | +Make sure to do a full security audit on your systems when banking rails connections are in place. Some banks provide a testing API that can be used for development and deployment to testnet or staging environments, which means you can test and audit the codebase before moving to a final production-ready bank integration. |
| 45 | + |
| 46 | +## Testing |
| 47 | + |
| 48 | +Once your application is fully functional, it's a good idea to test different scenarios and edge cases to make sure the system is behaving as expected. |
| 49 | + |
| 50 | +The SDF offers an [anchor validation test suite](https://anchor-validator.stellar.org/) and UI for testnet and mainnet testing. SEP-24 and SEP-31 are supported, containing a growing list of tests to assess your service's compliance with the protocol. While the coverage is good, the SDF does not claim that it is complete. |
| 51 | + |
| 52 | +Below are some tests that the suite does not and will not cover. |
| 53 | + |
| 54 | +### General Tests |
| 55 | + |
| 56 | +- Check that the issuing account is set up with the correct home domain, and that the website on that home domain has branding visuals, content about your company, clear language telling users how to report problems, and a method for contacting you to seek support. |
| 57 | + |
| 58 | +### Security Tests |
| 59 | + |
| 60 | +- Ensure distribution is done through a dedicated distribution account (not the issuing account) |
| 61 | +- Ensure market making is done through a dedicated account (not the issuing account) |
| 62 | +- Make sure all authenticated endpoints are not accessible without the JWT token |
0 commit comments