Sandbox and production share the same API host. Your API key selects the environment — not a different base URL.
Hosts#
| Environment | Base URL | How you select it |
|---|---|---|
| Production | https://api.avrix.io | API key with environment = production |
| Sandbox | https://api.avrix.io | API key with environment = sandbox |
Prefer a sandbox key for everyday integration work; use a production key only after go-live.
Confirm the environment on every deployment with:
# Prefer env vars — never hardcode secrets in source control
export AVRIX_API_KEY="avrix_sk_sbx_your_key_here"
export AVRIX_BASE_URL="https://api.avrix.io"data.environment must match the key you intended.
Key prefixes#
New and rotated secrets encode key type in the token prefix. Auth looks keys up by hash; the Console badge and GET /whoami remain authoritative when the prefix is ambiguous.
| Key type | Example prefix |
|---|---|
Live (production) | avrix_sk_live_… |
| Sandbox | avrix_sk_sbx_… |
Legacy keys may still use a plain avrix_sk_… shape until rotated. Always send the raw token
in Authorization: Bearer … — never a display label or a double Bearer prefix.
Behavioural differences#
| Topic | Sandbox | Production |
|---|---|---|
| Catalog | Shared fixture catalog | Your real agreements and allocations |
| Vendors | Fixture vendor | Your vendor relationships |
| Key material | Test keys, no commercial value | Real inventory, real cost |
Magic SKUs (SANDBOX-*) | Accepted | Rejected (SANDBOX_MAGIC_VALUE_REJECTED) |
Magic order / payment refs (sandbox_*) | Accepted | Rejected |
Commercial evidence (integrationOrderContext) | Minimal accepted | Full production set enforced |
| Consumer geo enforcement | Never enabled | Enabled when the deployment enables it |
| Webhooks | Isolated per API key on the shared sandbox catalog | Per registered endpoint on your company |
| Financial impact | None | Settlement obligations |
Sandbox fixtures#
Use these SKUs for certification and day-to-day testing:
| SKU | Purpose |
|---|---|
SANDBOX-ALWAYS-001 | Happy-path key fulfilment (pool replenished) |
SANDBOX-NOALLOC-001 | Not sellable — no allocation |
SANDBOX-NOSHARE-001 | Not sellable — no share |
SANDBOX-LIFECYCLE-001 | Discoverable but not transactable lifecycle state |
SANDBOX-NOKEYS-001 | Out-of-stock / NO_AVAILABLE_KEYS path |
Prefer SANDBOX-ALWAYS-001 for load and concurrent tests — other pools can be exhausted by other
integrators on the shared sandbox catalog.
Commercial evidence (production keys)#
Production keys enforce a larger integrationOrderContext set than sandbox keys. Implement the
production set from day one in sandbox so cutover does not surprise you with 422 responses.
See Order context for the full field matrix.
Capability discovery#
Optional features (checkout hold, consumer geo) appear on GET /whoami under
capabilities. Gate your client on those flags — do not assume a capability is on because it
worked in another environment.
Related#
- Sandbox — fixtures, isolation, triage
- Authentication — keys, scopes, rotation
- Sandbox to production — cutover narrative
- Certification — required test cases
- Go-live — production access checklist