Environments#

AuxCORE runs on two AuxCORE hosts: Sandbox and Production. Use the base URL that matches the dashboard where you log in.

Available environments#

Sandbox#

Public API base: https://uat.auxcore.net/api/v1/public

Pre-production validation for merchants and integrators
Test cards and sandbox gateway credentials
No real money movement
Same API surface as production
Use for QA sign-off before go-live
Docs (embedded): https://uat.auxcore.net/docs/introduction.html
Developer Portal (SDK & API Docs): https://uat.auxcore.net/settings/developer/sdk

Production#

Public API base: https://app.auxcore.net/api/v1/public

Live transactions and settlement
Live gateway credentials required
Swagger UI disabled in production builds
Static docs: https://docs.auxcore.net

Environment matrix#

Resource	Sandbox	Production
Dashboard	`uat.auxcore.net`	`app.auxcore.net`
Public API	`…/api/v1/public`	`…/api/v1/public`
PCI SDK	`vault.auxcore.net/sdk/`	same
API keys	`/settings/developer/api-keys` on same host	`/settings/developer/api-keys`
Developer Portal (SDK & API Docs)	`/settings/developer/sdk`	`/settings/developer/sdk`
HTML docs	`uat.auxcore.net/docs/`	`docs.auxcore.net`

Sandbox and production keys share the same prefixes (api-…, lpk_live_…). A key only works on the host where it was created, so the host — not the key prefix — decides the environment.

Switching environments#

Update base URL and use separate API keys per environment:

bash

# Sandbox example
export AUXCORE_API_BASE="https://uat.auxcore.net/api/v1/public"
export AUXCORE_API_KEY="your-sandbox-api-key"
export AUXCORE_PCI_SDK="https://vault.auxcore.net/sdk/auxVault.js"

# Production
export AUXCORE_API_BASE="https://app.auxcore.net/api/v1/public"
export AUXCORE_API_KEY="your-live-api-key"

javascript

const BASE_URL = process.env.AUXCORE_API_BASE;
const headers = {
  'x-api-key': process.env.AUXCORE_API_KEY,
  'Content-Type': 'application/json',
};
// Tenant and merchant are resolved from the key. ERP keys (lv_erp_…): also add 'X-Merchant-ID'

Key differences#

Feature	Sandbox	Production
Charges	Test — no settlement	Real money
Card numbers	Test PANs, typed into hosted PCI fields; the API takes a `pciToken` (a raw PAN gets `400 PCI_SCOPE_VIOLATION`)	Real cards, via `pciToken` only
API keys	Sandbox keys from Settings → Developer & Integrations → API Keys	Live keys only
Webhooks	Any publicly reachable URL	HTTPS strongly recommended (the API only checks the URL is well-formed)

Test cards (Sandbox only)#

See the test card list on the Testing page.

Go-live checklist#

All flows tested on Sandbox with production-like gateway config
Base URL switched to https://app.auxcore.net/api/v1/public
New live API keys created; Sandbox keys revoked or disabled
Webhooks point to production HTTPS URLs
SDK embed uses a live public key (data-api-key) and the prod data-endpoint
PCI embed origins allow your production domain

See Go-Live Checklist →

Next steps#

Need help? Contact support@auxcore.net