Sandbox and production

Get started

Keys separate the environments

The prefix is the whole mechanism: sk_test_ reaches the sandbox, sk_live_ reaches production, and neither can reach the other's data. Keys are also scoped per tool, so a leaked key is bounded twice.

Sandbox Production

What the sandbox simulates

What it does not do

Going live Swap the key and the base URL. Nothing else changes — same paths, same fields, same version header. Register your production webhook endpoint and its own secret before the first real mandate, because the sandbox secret will not verify a production event. See also Authentication → Rate limits → Status →