API Sandbox or Production: what each key really does, and moving your program to production

The short answer: the address and the operations are the same in both modes: the key decides. A sandbox_ key reads your real account data, but changes are simulated and never charged. A prod_ key reads and really changes the account. Going live means swapping the key.

The two modes side by side

	Sandbox (sandbox_)	Production (prod_)
Reads	Real account data	Real account data
Changes	Simulated	Change the account
Charges	Never	Yes, from credit, within the spending limit
X-API-Mode header in the answer	sandbox	production
What it is for	Building and testing without risk	Your finished program

Sandbox does not mean play data. A sandbox_ key reads your real domains, invoices and contacts. Guard it as carefully as a Production key.

How to tell an answer was simulated

1	Every answer to a keyed request carries the X-API-Mode header, with sandbox or production.

2	Simulated writes also carry X-API-Simulated: true.

3	The mode field of GET /v1/token gives the key's mode, and writes_simulated says whether writes are being simulated.

What the Sandbox simulates, area by area

Area	With a Sandbox key
Domains and extras	The purchase does not happen, and the answer says whether your credit would cover it and whether it fits the spending limit.
Invoices	credit_sufficient and within_spending_limit say whether the payment would go through. Nothing is charged.
Hosting and e-mail	The API checks the request but does not reach the server. Anything that depends on the server, such as whether something already exists, is only checked in Production.
VPS servers	No server is touched. The root password returned is not real.
Support	No ticket is created, and the id comes back as null.
SMS	The message is validated, but it is not sent and uses no credits.

One important exception: the protections for the account e-mail domain (the 409 account_email_domain) apply in Sandbox too, so your test shows what will happen in Production.

While the API is in preparation

At this stage not even prod_ keys change the account or charge: writes are simulated and writes_simulated is true. Keys created during the preparation, in either mode, are revoked when the API opens, and the account owner gets a notice by e-mail. After that, create new keys.

Moving your program to Production

1	Test everything in Sandbox, errors included: a key without permission, not enough credit, an invalid domain name.

2	Create a prod_ key on the API page in Meu MozOut, with minimal permissions, a sensible spending limit and, if you can, an IP list.

3	Swap the key in your program. In the request, the prefix is the only difference.

4	Send the X-API-Mode: production header with your requests. If the key is not in that mode, the API refuses with invalid_request and the reason mode_mismatch, so your program never runs with the wrong key.

curl https://api.mozout.co.mz/v1/domains -H "Authorization: Bearer $RLX_API_KEY" -H "X-API-Mode: production"

Some areas keep separate limits in Sandbox. For hosting and servers, requests with a sandbox_ key do not use up the Production limits. The other limits are in the API request limits.

Always start in the Sandbox: create a sandbox_ key and test your program without touching the account or spending credit.

Create a key

Categories

Categories