> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zerocash.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments

> How sandbox and production differ, and how to move between them safely.

Zerocash exposes one host. The environment you are in is determined by **which credentials you
authenticate with**, not by a different base URL.

<CodeGroup>
  ```bash Base URL theme={null}
  https://api.zerocash.tech
  ```
</CodeGroup>

<Info>
  Sandbox and production keys are separate. Generate a bearer token with your sandbox keys and
  you are transacting in sandbox; generate one with your production keys and you are moving real
  money.
</Info>

<Warning>
  One exception: [Simulate Webhook](/api-reference/endpoint/simulate-webhook) is sandbox-only and
  lives under its own path, `/api/sandbox/b2b/utilities/simulate-webhook`.
</Warning>

## What differs

|                    | Sandbox                                                                | Production                                  |
| :----------------- | :--------------------------------------------------------------------- | :------------------------------------------ |
| Credentials        | Sandbox public key + API key                                           | Production public key + API key             |
| Funds              | Simulated — nothing reaches a provider                                 | Real money leaves or enters your balance    |
| Outcomes           | Determined by [test values](/guides/testing/overview) you send         | Determined by the customer and the provider |
| Webhooks           | Delivered to your sandbox webhook URL                                  | Delivered to your production webhook URL    |
| Webhook simulation | [Simulate Webhook](/api-reference/endpoint/simulate-webhook) available | Not available                               |

Your webhook URLs for both environments are configured in the dashboard and returned by
[Get User](/api-reference/endpoint/get-user).

## Rules that apply in both

<CardGroup cols={2}>
  <Card title="Unique externalReference" icon="fingerprint">
    Use a fresh `externalReference` for every attempt. It is how you reconcile and how you avoid
    duplicate transactions on retry.
  </Card>

  <Card title="Only successful is settled" icon="circle-check">
    Treat `successful` as the sole fulfilled state. Pending and processing are not outcomes.
  </Card>

  <Card title="Confirm before granting value" icon="shield-check">
    Verify the final status by webhook or by [Get Transaction](/api-reference/endpoint/get-transaction)
    before you release goods or credit an account.
  </Card>

  <Card title="Never mix credentials" icon="ban">
    Keep production keys out of test requests, and never send real card details to sandbox.
  </Card>
</CardGroup>

## Going live

<Steps>
  <Step title="Exercise both outcomes in sandbox">
    Run each collection and payout method you intend to use, covering the success **and** failure
    test values, not just the happy path.
  </Step>

  <Step title="Verify webhook signatures">
    Confirm your endpoint validates the signature header before trusting a payload. See
    [Webhook secrets](/guides/webhooks/secrets).
  </Step>

  <Step title="Swap credentials">
    Point your integration at your production public key and API key. No URL changes are needed.
  </Step>

  <Step title="Confirm coverage and limits">
    Check [supported countries and limits](/guides/supported-countries) for the corridors you are
    launching, and your fees on the [account fees](/guides/account-fees) page.
  </Step>
</Steps>

<Warning>
  Before your first production transaction, confirm that your production webhook URL is set and
  reachable. Money movement is asynchronous — without webhooks you will be polling for every
  outcome.
</Warning>