Environments

Base URLs

Environment	Base URL
Sandbox	`https://sandbox.payme.io/api/`
Production	`https://live.payme.io/api/`

Point every request at the right environment with that environment's credentials. Endpoint pages show both URLs.

A full endpoint URL is the base URL plus the path, for example https://sandbox.payme.io/api/generate-sale and https://live.payme.io/api/refund-sale.

⚠ TO CONFIRM: Sandbox and production credentials are most likely fully separate — each environment generates its own keys, so a sandbox key should be rejected by live.payme.io and vice versa. Please confirm the environments share no credentials. [Q10]

Other APIs

B2B Payments uses the same hosts, the same /api prefix and the same payme_client_key / seller_payme_id authentication as the Payments API: payment contracts under /api/payment-contracts, wallet transfers under /api/sales and /api/transfer.
Keep: endpoint pages show full URLs such as https://sandbox.payme.io/api/partner/api/documents/income and https://live.payme.io/api/partner/api/documents/income. Other Keep paths start with /oauth2/token, /public/... and /seller/api/....

⚠ TO CONFIRM: What are the real sandbox and production base URLs for the Keep API, including the OAuth token endpoint (/oauth2/token) and the /public/... and /seller/api/... paths? [Q40]

⚠ TO CONFIRM: What are the real sandbox and production base URLs for the Products & Customers API (/auth/token, /products, /customers)? Is it really https://sandbox.payme.io/api / https://live.payme.io/api? [Q41]

Hosts you will see besides the API

The payment page (`sale_url`)

generate-sale returns a sale_url — the secured payment page to show the buyer. It is built as the environment's base URL followed by /sale/generate/<id>, or /sale/template/<id> for template sales.

Use sale_url exactly as returned; do not build it yourself or hard-code its host.

⚠ TO CONFIRM: The sale_url host is most likely sandbox.payme.io in the sandbox and live.payme.io in production; the preprod.paymeservice.com host in some documented examples (and in the 3D Secure postMessage origin check) appears to be a pre-production host. Please confirm the hosts per environment, so examples and iframe / Content-Security-Policy allow-lists can be corrected. [Q38]

Browser scripts

PayMe's browser scripts are served from cdn.paymeservice.com (for example //cdn.paymeservice.com/jsapi/v1/payme.min.js). The Apple Pay and Google Pay guides load hostedfields.js from cdn.paymeservice.com; the Hosted Fields guide shows cdn.payme.io/hf/v1/hostedfields.js.

⚠ TO CONFIRM: cdn.paymeservice.com is the domain in use, so the Hosted Fields script is most likely https://cdn.paymeservice.com/hf/v1/hostedfields.js and cdn.payme.io is outdated. Please confirm the exact Hosted Fields path, and whether it is the same for sandbox and production. [Q39]

In browser code, sandbox vs production is chosen with testMode (default false): PayMe.create(apiKey, { testMode: true }) for the sandbox. Setting it to false sends requests to production.

Testing in the sandbox

Use test data only in the sandbox. Full list: Test Cards and Payment Methods.

Main test cards (all expire 12/30, Social ID 008336174):

Card number	CVV	Behaviour
`4557430402053431`	`200`	International non-Israeli card; one installment only; ILS, USD, EUR
`375516193000090`	`0957`	International Israeli card; multiple installments; ILS, USD, EUR
`5326105300985846`	`658`	Local Israeli card; multiple installments; ILS only

Cards that force a decline

Outside production these cards always fail. The response is HTTP 200 with status_code: 1 and:

Card number	`status_error_code`	Message (with `language: "en"`)
`4000000000000002`	`20004`	Refusal by credit company. Please try a different card
`4000000000000051`	`21001`	The card is blocked
`4000000000000085`	`21002`	The card is stolen
`4000000000000069`	`21004`	The card is expired
`4242424242424241`	`21005`	Incorrect card number
`4000000000000135`	`21006`	The credit limit has been reached
`4000000000000101`	`21007`	CVV/ID is required but was not entered
`4000000000000127`	`21008`	Incorrect CVV or ID
`4000000000000036`	`20004`	Saving (tokenizing) the card succeeds; charging it later, including with its `buyer_key`, is refused

Other sandbox test data

Israeli direct debit: bank 54, branch 112, account 2222111 is approved after 60 seconds; branch 113, account 4444333 is declined after 60 seconds. In the sandbox you only receive bank-authorization statuses 1 or 2.
SEPA and BACS: test account numbers drive the status from initial to completed, failed or chargeback.
Creating test sellers (partners): seller_social_id 9999999999, seller_email random@paymeservice.com (suppresses automatic emails), seller_bank_code 54, any 3-digit branch, any 6-digit account.

Merchant dashboard

create-seller returns a sign-up link to the merchant dashboard in seller_dashboard_signup_link.

⚠ TO CONFIRM: Each environment most likely has its own merchant dashboard (the partner's white-label dashboard if one is set, otherwise PayMe's default). What is the URL of PayMe's default sandbox dashboard, where a developer can see test sales? [Q43]