# Environments

AuxCORE runs on two AuxCORE hosts: **Sandbox** and **Production**. Use the base URL that matches the dashboard where you log in.

---

## Available environments

### Sandbox

**Public API base:** `https://uat.auxcore.net/api/v1/public`

- Pre-production validation for merchants and integrators
- Test cards and sandbox gateway credentials
- No real money movement
- Same API surface as production
- Use for QA sign-off before go-live
- Docs (embedded): `https://uat.auxcore.net/docs/introduction.html`
- Developer Portal (SDK & API Docs): `https://uat.auxcore.net/settings/developer/sdk`

### Production

**Public API base:** `https://app.auxcore.net/api/v1/public`

- Live transactions and settlement
- Live gateway credentials required
- Swagger UI disabled in production builds
- Static docs: `https://docs.auxcore.net`

---

## Environment matrix

| Resource | Sandbox | Production |
|----------|---------|------------|
| Dashboard | `uat.auxcore.net` | `app.auxcore.net` |
| Public API | `…/api/v1/public` | `…/api/v1/public` |
| PCI SDK | `vault.auxcore.net/sdk/` | same |
| API keys | `/settings/developer/api-keys` on same host | `/settings/developer/api-keys` |
| Developer Portal (SDK & API Docs) | `/settings/developer/sdk` | `/settings/developer/sdk` |
| HTML docs | `uat.auxcore.net/docs/` | `docs.auxcore.net` |

Sandbox and production keys share the same prefixes (`api-…`, `lpk_live_…`). A key only works on the host where it was created, so the host — not the key prefix — decides the environment.

---

## Switching environments

Update base URL and use **separate API keys** per environment:

```bash
# Sandbox example
export AUXCORE_API_BASE="https://uat.auxcore.net/api/v1/public"
export AUXCORE_API_KEY="your-sandbox-api-key"
export AUXCORE_PCI_SDK="https://vault.auxcore.net/sdk/auxVault.js"

# Production
export AUXCORE_API_BASE="https://app.auxcore.net/api/v1/public"
export AUXCORE_API_KEY="your-live-api-key"
```

```javascript
const BASE_URL = process.env.AUXCORE_API_BASE;
const headers = {
  'x-api-key': process.env.AUXCORE_API_KEY,
  'Content-Type': 'application/json',
};
// Tenant and merchant are resolved from the key. ERP keys (lv_erp_…): also add 'X-Merchant-ID'
```

---

## Key differences

| Feature | Sandbox | Production |
|---------|-----------|------------|
| **Charges** | Test — no settlement | Real money |
| **Card numbers** | Test PANs, typed into hosted PCI fields; the API takes a `pciToken` (a raw PAN gets `400 PCI_SCOPE_VIOLATION`) | Real cards, via `pciToken` only |
| **API keys** | Sandbox keys from Settings → Developer & Integrations → API Keys | Live keys only |
| **Webhooks** | Any publicly reachable URL | HTTPS strongly recommended (the API only checks the URL is well-formed) |

---

## Test cards (Sandbox only)

See the [test card list](./testing.md#test-cards) on the Testing page.

---

## Go-live checklist

- [ ] All flows tested on **Sandbox** with production-like gateway config
- [ ] Base URL switched to `https://app.auxcore.net/api/v1/public`
- [ ] New **live** API keys created; Sandbox keys revoked or disabled
- [ ] Webhooks point to production HTTPS URLs
- [ ] SDK embed uses a live public key (`data-api-key`) and the prod `data-endpoint`
- [ ] PCI embed origins allow your production domain

See [Go-Live Checklist →](../guides/go-live-checklist.md)

---

## Next steps

- [Quick Start →](./quickstart.md)
- [Authentication →](./authentication.md)
- [Testing Guide →](./testing.md)

---

**Need help?** Contact support@auxcore.net