Environments & auth
Environments & authentication
Three isolated environments. Sandbox has synthetic customers and instant card delivery so every flow is walkable without real money. Only the sandbox is callable from this portal — try-it refuses anything else, and an environment whose base URL is not yet verified says so rather than handing you one that quietly reaches the sandbox.
Environments
- sandbox
- Build and demo. Synthetic data, instant issuance, relaxed limits.6 base URLs, one per API — listed on the tools page
- uat
- Bank acceptance testing against production-like configuration.Base URL not yet published for this environment.
- prod
- Live traffic. mTLS + IP allow-listing required in addition to OAuth2.Base URL not yet published for this environment.
Authentication
OAuth2 client credentials against the Security Token Service. Tokens live 30 minutes; scopes gate capabilities (cards.issue, cards.manage, transactions, statements, disputes).
- TLS 1.2+
- mTLS in production
- HMAC-signed webhooks
- Field-level encryption for PIN & PAN
What the specifications do not sayNo spec declares a securityScheme, so none of them state where the token goes. The token endpoint accepts several grant types but publishes no list, no scope catalogue and no token_type. And /sts/api/authorize is a back-channel POST that takes a client secret — not the browser redirect its name suggests. Treat this page as the contract until the specs carry one.