Environments & auth
Environments & authentication
Three isolated environments. Sandbox has synthetic customers and instant card delivery so every flow is walkable without real money. Only the sandbox is callable from this portal — try-it refuses anything else, and an environment whose base URL is not yet verified says so rather than handing you one that quietly reaches the sandbox.
Environments
- sandbox
- Build and demo. Synthetic data, instant issuance, relaxed limits.6 base URLs, one per API — listed on the tools page
- uat
- Bank acceptance testing against production-like configuration.Base URL not yet published for this environment.
- prod
- Live traffic. mTLS + IP allow-listing required in addition to OAuth2.Base URL not yet published for this environment.
Authentication
OAuth2 client credentials against the Security Token Service. Tokens live 30 minutes; scopes gate capabilities (cards.issue, cards.manage, transactions, statements, disputes).
- TLS 1.2+
- mTLS in production
- HMAC-signed webhooks
- Field-level encryption for PIN & PAN
How a token is obtained, which grant applies, what it is worth and what the specifications leave unsaid are on Authentication and authorisation. To make the call rather than read about it, start at Make your first call.