Skip to main content
Therius routes every request to either the sandbox or the production environment based solely on the prefix of the API key you send. There is no environment flag, no separate SDK initialization option, and no configuration file to change. When you are ready to go live, you swap the key prefix and update the base URL — nothing else.

​
Sandbox

The sandbox environment is a fully isolated test environment backed by a test-provider stub. No real card networks are involved, no real money moves, and no real accounts are charged. Use it freely during development and for automated testing pipelines.

​
Sandbox Test Cards

Use any future expiry date, any cardholder name, and any 3-digit CVV (4 digits for Amex).

Full testing reference

Every test card by network, decline scenarios by reason, the complete 3D Secure walkthrough, and APM sandbox responses.

​
Production

The production environment processes real payments over live card networks. Every charge is real, every refund affects real accounts, and every declined transaction is a real issuer decision.

​
Sandbox vs Production at a Glance

​
Switching Environments

To move from sandbox to production, make two changes in your configuration:
  1. Replace prv_sandbox_... with prv_production_... (and pub_sandbox_... with pub_production_...).
  2. Update the base URL from https://api-sandbox.therius.io/v1 to https://api.therius.io/v1.
No other code changes are required. The same request bodies, the same response shapes, and the same endpoint paths work in both environments.
Before switching to production, verify that every mutating request in your code sends an Idempotency-Key header. In the sandbox this is optional; in production it is required to prevent duplicate charges on network retries.

​
The X-Environment Header

API calls authenticate with a key (or, from the browser, a short-lived clientToken), and the credential determines the environment: the key prefix (prv_sandbox_ or prv_production_) or the environment the clientToken was issued for. This includes GET /payment/inquiry/{id}, which requires a private key or a clientToken and no longer accepts an unauthenticated request.
Valid values for the X-Environment header are sandbox and production, but when you include an API key you do not need it — the key prefix takes precedence.