Environments and approval

Sandbox works the moment you create an application. Production is reviewed by a person, and until that review lands your sandbox keys keep working exactly as they do now.

Two environments, two keys

Every application gets both. The prefix on the secret is what selects the environment, so there is no environment flag to set and no way to point a sandbox key at production by accident.

Environment	Secret prefix	What happens
Sandbox	`sk_test_`	Orders run the real engine against real restaurant sites. Nothing is ever placed, nothing is charged, and the person is never texted.
Production	`sk_live_`	Real orders, real money, real people. Requires approval.

Sandbox is not a mock. It resolves the same stores, reads the same live menus, and fails in the same places a real order fails. What it will not do is submit.

How approval works

When you create an application it starts under review. We read it by hand, usually within a business day, and email you the decision. There is no form to chase and nothing to schedule.

Status	Sandbox	Production	What it means
Under review	Works	Refused	The default for a new application. Build against sandbox while you wait.
Approved	Works	Works	Production keys are live. Sandbox keeps working alongside them.
Sandbox only	Works	Refused	We reviewed it and did not enable production. Your integration keeps running; nothing you built stops.
Suspended	Refused	Refused	Both environments are closed. We will have contacted you.

A declined review leaves sandbox working. It is not a shutdown, and you do not need to change any code to keep developing.

What a refused production call looks like

A production key on an application that is not approved is refused with 403 and this body, which is byte-for-byte what every other refusal returns:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API credentials."
  }
}

That is deliberate. Telling a caller why a credential was refused tells an attacker which of their guesses was closest, so the API says the same thing every time. The real reason is recorded and shown to you, and only to you, on the application's Refusals page in the console. See Errors and status for the full list of reasons that page can show.

Going to production

Build and test against sk_test_. Nothing about the request shape changes later.
Wait for the approval email, or check the application in the console.
Swap the secret for the sk_live_ one. That is the entire migration.

Read your sandbox and production secrets from configuration rather than branching on them in code. There is no other difference between the two environments to branch on.

Authentication →