Environments

Overview

Every project has two environments: sandbox and production. They share the same dashboard and the same project, but everything else — payments, payment links, balances — is kept completely separate.

Sandbox simulates a real bank/QRIS provider without moving real money. Use it while you build and test your integration.
Production processes real payments and requires your project to have passed KYC review first.

How isolation works

Sandbox and production data never mix:

A sandbox API key can only read or write sandbox data, and a production key only production data — there’s no request parameter that switches environments, so a leaked key can’t be pointed at the other one.
Payment links, payments, and balances created in sandbox are invisible to production, and vice versa.
The dashboard’s environment switcher only changes what you’re viewing — the actual access boundary is enforced by which API key (or, in the dashboard itself, which session context) you’re using, not by anything the client sends.

API keys are environment-scoped

An API key’s secret tells you which environment it belongs to:

sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create one key per project per environment from the project’s API Key tab in the dashboard — see Authentication. A sandbox key never grants access to production data, so treat “going live” as swapping the key your backend uses, not changing any request you send.

Going to production

See Go Live for the full checklist — completing KYC, creating a production key, and swapping it into your backend.