Skip to main content
FraudEG gives you two fully isolated environments — sandbox and production — so you can build, test, and iterate without any risk of affecting real transactions or real customers. The sandbox is not a stripped-down emulator: it has complete feature parity with production, including risk scoring, rule evaluation, workflow execution, and webhook delivery. The only difference is that no real money moves and no real identity data is processed.
Never use sandbox API keys (feg_test_sk_...) in your production environment, or live keys (feg_live_sk_...) in development or testing environments. Sandbox events do not count toward fraud model training, and live keys in non-production environments may expose real customer data or trigger real financial actions.

​
Environment separation

Each environment is completely isolated: The base URL is the same for both environments: https://api.fraudeg.com/v1. FraudEG determines which environment to use based on the API key you supply in the Authorization header — no URL change required.

​
API key naming convention

Secret keys (sk) have full read/write API access and must never be exposed in client-side code, mobile apps, or public repositories. Public keys (pk) are safe to embed in browser or mobile SDKs and are restricted to read-only, client-safe operations. Manage and rotate your keys at any time in Settings → API Keys.

​
Sandbox features

The sandbox environment gives you everything you need to build and validate your integration:
  • Full API parity — every endpoint, parameter, and response field available in production is available in sandbox
  • Simulated fraud scenarios — use test signal values and magic amounts to trigger specific risk outcomes (see the test scenarios table below)
  • Test identities and test card numbers — a library of synthetic users and card numbers that exercise the full range of KYC and payment outcomes
  • Safe environment — no real transactions are submitted to payment rails and no real identity documents are verified
  • Rule simulation mode — test risk rules against synthetic or historical payloads before promoting them to production
Run all load and stress testing in the sandbox. Production infrastructure is scaled for live traffic patterns, and synthetic load in production can skew fraud model signals and risk scoring for real users.

​
Sandbox test scenarios

Use the following magic values in your API requests to trigger deterministic outcomes in the sandbox: These values override the ML scoring model in the sandbox only. They have no effect in production.

​
Production checklist

Before switching your integration to live traffic, work through the following checklist:
  • Replace all sandbox keys (feg_test_sk_...) with live keys (feg_live_sk_...)
  • Update webhook endpoint URLs to production-grade, publicly reachable URLs
  • Enable the risk rules you have validated in the sandbox
  • Enable and test the workflows you have built in the sandbox
  • Set up monitoring and alerting in Platform → Workflows (e.g., a PagerDuty alert for high-volume blocking events)
  • Complete FraudEG account verification — live API access requires identity and business verification, which you can complete in Settings → Account Verification

​
Migrate from sandbox to production

1

Verify your account

Go to Settings → Account Verification and complete the business identity check. FraudEG requires this before activating live API access.
2

Retrieve your live API keys

Go to Settings → API Keys and copy your feg_live_sk_... and feg_live_pk_... keys. Store the secret key in your secrets manager — you will not be able to view it again after closing the modal.
3

Update your server configuration

Replace every instance of your sandbox secret key in your server environment variables and secrets manager with the live secret key. Leave your sandbox keys intact in any non-production environments you use for testing and development.
4

Configure production webhooks

Go to Platform → Webhooks and add your production webhook endpoint URL. Verify the endpoint by clicking Send Test Event — FraudEG will POST a webhook.test event and expect a 200 response within five seconds.
5

Enable risk rules and workflows

Review the rules and workflows you validated in sandbox. Toggle each one to Enabled in the production dashboard view. Confirm rule priority order before enabling.
6

Enable integrations

For each connected integration, ensure you have entered production credentials from the provider and toggled the integration to Production in Platform → Integrations.
7

Monitor your first live events

Watch Platform → Events and Platform → Workflows → Execution Logs closely during your first hour of live traffic. Verify that decisions, signals, and workflow actions match your expectations before scaling up volume.