# Environments

## Base URLs

| Environment | Base URL |
|-------------|----------|
| Sandbox | `https://sandbox.payme.io/api/` |
| Production | `https://live.payme.io/api/` |

Point every request at the right environment **with that environment's credentials**. Endpoint pages show both URLs. 

A full endpoint URL is the base URL plus the path, for example `https://sandbox.payme.io/api/generate-sale` and `https://live.payme.io/api/refund-sale`. 

> ⚠ TO CONFIRM: Sandbox and production credentials are most likely fully separate — each environment generates its own keys, so a sandbox key should be rejected by `live.payme.io` and vice versa. Please confirm the environments share no credentials. [Q10]

### Other APIs

- **B2B Payments** uses the same hosts, the same `/api` prefix and the same `payme_client_key` / `seller_payme_id` authentication as the Payments API: payment contracts under `/api/payment-contracts`, wallet transfers under `/api/sales` and `/api/transfer`. 
- **Keep:** endpoint pages show full URLs such as `https://sandbox.payme.io/api/partner/api/documents/income` and `https://live.payme.io/api/partner/api/documents/income`.  Other Keep paths start with `/oauth2/token`, `/public/...` and `/seller/api/...`. 

> ⚠ TO CONFIRM: What are the real sandbox and production base URLs for the Keep API, including the OAuth token endpoint (`/oauth2/token`) and the `/public/...` and `/seller/api/...` paths? [Q40]

> ⚠ TO CONFIRM: What are the real sandbox and production base URLs for the Products & Customers API (`/auth/token`, `/products`, `/customers`)? Is it really `https://sandbox.payme.io/api` / `https://live.payme.io/api`? [Q41]

## Hosts you will see besides the API

### The payment page (`sale_url`)

`generate-sale` returns a `sale_url` — the secured payment page to show the buyer.  It is built as the environment's base URL followed by `/sale/generate/<id>`, or `/sale/template/<id>` for template sales. 

**Use `sale_url` exactly as returned**; do not build it yourself or hard-code its host.

> ⚠ TO CONFIRM: The `sale_url` host is most likely `sandbox.payme.io` in the sandbox and `live.payme.io` in production; the `preprod.paymeservice.com` host in some documented examples (and in the 3D Secure `postMessage` origin check) appears to be a pre-production host. Please confirm the hosts per environment, so examples and iframe / Content-Security-Policy allow-lists can be corrected. [Q38]

### Browser scripts

PayMe's browser scripts are served from `cdn.paymeservice.com` (for example `//cdn.paymeservice.com/jsapi/v1/payme.min.js`).  The Apple Pay and Google Pay guides load `hostedfields.js` from `cdn.paymeservice.com`; the Hosted Fields guide shows `cdn.payme.io/hf/v1/hostedfields.js`. 

> ⚠ TO CONFIRM: `cdn.paymeservice.com` is the domain in use, so the Hosted Fields script is most likely `https://cdn.paymeservice.com/hf/v1/hostedfields.js` and `cdn.payme.io` is outdated. Please confirm the exact Hosted Fields path, and whether it is the same for sandbox and production. [Q39]

In browser code, sandbox vs production is chosen with `testMode` (default `false`): `PayMe.create(apiKey, { testMode: true })` for the sandbox. Setting it to `false` sends requests to production. 

## Testing in the sandbox

Use test data **only in the sandbox**. Full list: [Test Cards and Payment Methods](/payments/introduction/test-cards-and-payment-methods). 

Main test cards (all expire `12/30`, Social ID `008336174`):

| Card number | CVV | Behaviour |
|-------------|-----|-----------|
| `4557430402053431` | `200` | International non-Israeli card; one installment only; ILS, USD, EUR |
| `375516193000090` | `0957` | International Israeli card; multiple installments; ILS, USD, EUR |
| `5326105300985846` | `658` | Local Israeli card; multiple installments; ILS only |



### Cards that force a decline

Outside production these cards always fail. The response is **HTTP 200** with `status_code: 1` and: 

| Card number | `status_error_code` | Message (with `language: "en"`) |
|-------------|--------------------|---------------------------------|
| `4000000000000002` | `20004` | Refusal by credit company. Please try a different card |
| `4000000000000051` | `21001` | The card is blocked |
| `4000000000000085` | `21002` | The card is stolen |
| `4000000000000069` | `21004` | The card is expired |
| `4242424242424241` | `21005` | Incorrect card number |
| `4000000000000135` | `21006` | The credit limit has been reached |
| `4000000000000101` | `21007` | CVV/ID is required but was not entered |
| `4000000000000127` | `21008` | Incorrect CVV or ID |
| `4000000000000036` | `20004` | Saving (tokenizing) the card succeeds; charging it later, including with its `buyer_key`, is refused |

### Other sandbox test data

- **Israeli direct debit:** bank `54`, branch `112`, account `2222111` is approved after 60 seconds; branch `113`, account `4444333` is declined after 60 seconds. In the sandbox you only receive bank-authorization statuses 1 or 2. 
- **SEPA and BACS:** test account numbers drive the status from `initial` to `completed`, `failed` or `chargeback`. 
- **Creating test sellers (partners):** `seller_social_id` `9999999999`, `seller_email` `random@paymeservice.com` (suppresses automatic emails), `seller_bank_code` `54`, any 3-digit branch, any 6-digit account. 

### Merchant dashboard

`create-seller` returns a sign-up link to the merchant dashboard in `seller_dashboard_signup_link`. 

> ⚠ TO CONFIRM: Each environment most likely has its own merchant dashboard (the partner's white-label dashboard if one is set, otherwise PayMe's default). What is the URL of PayMe's default sandbox dashboard, where a developer can see test sales? [Q43]