# Going live

Source: https://docs.usetone.ai/flows/going-live

> What has to be true before a real phone rings, and in what order.

Everything you built against a `tone_test_` key works unchanged. Going live is a
key swap — but a few things must be true first, and some of them take days
rather than minutes.

## The order that saves time

| # | Step | Where | Wait |
|---|---|---|---|
| 1 | Business identity — GSTIN or PAN, CIN if you have one | Dashboard | Minutes |
| 2 | Authorised-signatory KYC | Dashboard | Minutes to hours |
| 3 | DLT Principal Entity ID | Dashboard, after registering with an operator | **Days** — start it first |
| 4 | Declare your sender classification | Dashboard | Minutes |
| 5 | Fund the wallet | Dashboard, via Razorpay | Minutes |
| 6 | Buy a number | API | Minutes |
| 7 | Mint a `tone_live_` key | Dashboard | Seconds |

**Start step 3 on day one.** DLT registration involves an external operator and
is the only step measured in days. Everything else can happen while it is in
flight, and all of steps 1–5 are deliberately dashboard-only: they are decisions
an accountable person makes, not something a deploy script does.

## Why those are not API routes

An API key cannot complete KYC, declare your sender classification, or spend
money. Each of those is a statement about who your company is and what it is
allowed to do — and a key that could make them would let a compromised key make
them too. Calling them with `$TONE_KEY` gets a `403`, deliberately.

## The swap

```diff
- TONE_KEY=tone_test_...
+ TONE_KEY=tone_live_...
```

That is the whole change. Same endpoints, same request shapes, same responses,
same webhook signatures.

## What actually changes

| | Test | Live |
|---|---|---|
| Calls | Fixed outcomes, nobody speaks | Real audio, real people |
| `billedPaise` | `0` | Real money |
| Numbers | Free from the sandbox pool | Bought, with monthly rent |
| Compliance gate | Runs, with the same rules | Runs |
| Webhooks | Sent, signed identically | Sent |

🔴 **Agents and knowledge bases are shared across both environments; calls and
numbers are not.** One agent object serves both universes, so publishing a change
in test publishes it for live. Calls and numbers are environment-scoped, and a
`tone_test_` key structurally cannot read live calls — `environment_mismatch` if
you try.

## Before your first real campaign

- Check `GET /v1/limits` and set `maxConcurrent` at or below your quota.
- Set `autoPauseBelowPaise` so a campaign stops rather than failing mid-run.
- Load your existing suppression list via `POST /v1/dnc/bulk`.
- Confirm your calling window and retry tail fit the legal band for your purpose,
  or launch will refuse.