PRODUCTION

Integrating into your website.

Production is a different environment from Sandbox. Register a Live application, then use an AI assistant or manual steps to configure Live credentials and Connect usage on your real website.

Still testing locally? Start with Sandbox. Reuse the same integration code — swap in Live credentials and production URLs.

1. Register a Live application

In Developers, choose Live (not Sandbox). Register your production website and exact HTTPS callback URLs, then generate a Live API key after approval.

Live URLs (example)

Website: https://your-website.com
Callback: https://your-website.com/api/bmm/callback

Sandbox and Live stay separate: different apps, keys, consent and attribution. Users who connected in Sandbox must authorise your Live app again.

2. Choose how to set up

Let an AI assistant wire Live Connect into your production site, or follow the manual setup and usage steps yourself.

Manual production setup

Configure Live credentials, install the SDK (or keep the integration you tested in Sandbox), bind real user sessions, then verify usage on your live domain.

Configure Live environment variables

On your hosting provider, set server-only Live credentials. Do not reuse Sandbox values in production.

Production environment (example)

BMM_ORIGIN="https://buymeamalt.com"
BMM_CLIENT_ID="your-approved-live-application-id"
BMM_API_KEY="your-live-server-only-api-key"
APP_ORIGIN="https://your-website.com"
BMM_REDIRECT_URI="https://your-website.com/api/bmm/callback"

Keep the API key out of browser code and public env vars. APP_ORIGIN is required for Next.js apps that check request origin.

Install or reuse the SDK

If you already integrated in Sandbox, keep that code and point it at Live credentials. Starting fresh? Install the package on your server.

npm install buymeamalt

Use buymeamalt for Node.js or buymeamalt/next for Next.js. Configure the client with your Live env values and derive getUserId from your authenticated server session — never from a form or query string.

Next.js server module (example)

import { createBmmConnect } from "buymeamalt/next";
import { auth } from "@/auth";

export const bmm = createBmmConnect({
  origin: process.env.BMM_ORIGIN,
  clientId: process.env.BMM_CLIENT_ID,
  apiKey: process.env.BMM_API_KEY,
  callbackUrl: process.env.BMM_REDIRECT_URI,
  getUserId: async () => (await auth())?.user.id,
});

Export handlers.connect, handlers.callback and handlers.disconnect from your App Router routes. Full examples: SDK guide.

Connect a user

From an authenticated page, start the connection. The creator signs in on BMM, approves access, and returns to your Live callback.

Connect control

<form action="/api/bmm/connect" method="post">
  <button type="submit">Connect BMM</button>
</form>

Display the support button

Read the connection on the server. Show the attributed support_url unchanged and open it in a new tab. Live links can accept real payments.

Support button

const creator = await bmm.getConnection();

{creator?.support_url && (
  <a href={creator.support_url} target="_blank" rel="noopener noreferrer">
    Buy me a malt ↗
  </a>
)}

If getConnection() returns null, show Connect BMM. If only support_url is null, keep the profile and omit the button.

Optional earnings

Only call getEarnings() when earnings_shared is true. These are settled earnings from your Live application after fees — not a withdrawable balance.

Optional earnings

let support = null;
if (creator?.earnings_shared) {
  try {
    support = await bmm.getEarnings();
  } catch (error) {
    if (error.status !== 403) throw error;
  }
}

Allow disconnect

Confirm before disconnecting. Show success only after the server confirms. Also link to BMM → Share → Connected apps.

Disconnect

<form action="/api/bmm/disconnect" method="post">
  <button type="submit">Disconnect BMM</button>
</form>

Verify on your live domain

Run through the full journey on production before inviting creators.

Callback URL matches the approved Live URL exactly (HTTPS).
Live client ID and API key are the ones shown in Developers.
Connect, cancelled consent, support button and disconnect work.
Optional earnings hide correctly when permission is denied.

Use the security and testing checklist before going live. For failures, see errors and recovery.