> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudeg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox and Production Environments in FraudEG API

> Use FraudEG's sandbox environment to test integrations, simulate fraud scenarios, and validate risk rules before going live in production.

FraudEG gives you two fully isolated environments — **sandbox** and **production** — so you can build, test, and iterate without any risk of affecting real transactions or real customers. The sandbox is not a stripped-down emulator: it has complete feature parity with production, including risk scoring, rule evaluation, workflow execution, and webhook delivery. The only difference is that no real money moves and no real identity data is processed.

<Warning>
  Never use sandbox API keys (`feg_test_sk_...`) in your production environment, or live keys (`feg_live_sk_...`) in development or testing environments. Sandbox events do not count toward fraud model training, and live keys in non-production environments may expose real customer data or trigger real financial actions.
</Warning>

***

## Environment separation

Each environment is completely isolated:

|                       | Sandbox                                  | Production                                  |
| --------------------- | ---------------------------------------- | ------------------------------------------- |
| **API keys**          | `feg_test_sk_...` / `feg_test_pk_...`    | `feg_live_sk_...` / `feg_live_pk_...`       |
| **Data**              | Synthetic test data only                 | Real customer and transaction data          |
| **Dashboard view**    | Toggle: **Sandbox** label in the nav bar | Toggle: **Production** label in the nav bar |
| **Billing**           | Not metered                              | Metered per event                           |
| **Real transactions** | ❌                                        | ✅                                           |

The **base URL is the same** for both environments: `https://api.fraudeg.com/v1`. FraudEG determines which environment to use based on the API key you supply in the `Authorization` header — no URL change required.

***

## API key naming convention

```text theme={null}
# Sandbox keys
feg_test_sk_xxxxxxxxxxxxxxxxxxxx   ← secret key (server-side only)
feg_test_pk_xxxxxxxxxxxxxxxxxxxx   ← public key (client-side safe)

# Production keys
feg_live_sk_xxxxxxxxxxxxxxxxxxxx   ← secret key (server-side only)
feg_live_pk_xxxxxxxxxxxxxxxxxxxx   ← public key (client-side safe)
```

Secret keys (`sk`) have full read/write API access and must never be exposed in client-side code, mobile apps, or public repositories. Public keys (`pk`) are safe to embed in browser or mobile SDKs and are restricted to read-only, client-safe operations.

Manage and rotate your keys at any time in **Settings → API Keys**.

***

## Sandbox features

The sandbox environment gives you everything you need to build and validate your integration:

* **Full API parity** — every endpoint, parameter, and response field available in production is available in sandbox
* **Simulated fraud scenarios** — use test signal values and magic amounts to trigger specific risk outcomes (see the test scenarios table below)
* **Test identities and test card numbers** — a library of synthetic users and card numbers that exercise the full range of KYC and payment outcomes
* **Safe environment** — no real transactions are submitted to payment rails and no real identity documents are verified
* **Rule simulation mode** — test risk rules against synthetic or historical payloads before promoting them to production

<Tip>
  Run all load and stress testing in the sandbox. Production infrastructure is scaled for live traffic patterns, and synthetic load in production can skew fraud model signals and risk scoring for real users.
</Tip>

***

## Sandbox test scenarios

Use the following magic values in your API requests to trigger deterministic outcomes in the sandbox:

| Test value                                 | Outcome triggered                                    |
| ------------------------------------------ | ---------------------------------------------------- |
| `amount: 999999`                           | `block` decision returned                            |
| `amount: 500000`                           | `challenge` decision returned                        |
| `user.email: "highrisk@fraudeg-test.com"`  | High risk score (≥ 85) returned                      |
| `user.email: "verified@fraudeg-test.com"`  | Identity verified, low risk score returned           |
| `user.email: "watchlist@fraudeg-test.com"` | Watchlist match simulated, `block` decision returned |

These values override the ML scoring model in the sandbox only. They have no effect in production.

***

## Production checklist

Before switching your integration to live traffic, work through the following checklist:

* [ ] Replace all sandbox keys (`feg_test_sk_...`) with live keys (`feg_live_sk_...`)
* [ ] Update webhook endpoint URLs to production-grade, publicly reachable URLs
* [ ] Enable the risk rules you have validated in the sandbox
* [ ] Enable and test the workflows you have built in the sandbox
* [ ] Set up monitoring and alerting in **Platform → Workflows** (e.g., a PagerDuty alert for high-volume blocking events)
* [ ] Complete FraudEG account verification — live API access requires identity and business verification, which you can complete in **Settings → Account Verification**

***

## Migrate from sandbox to production

<Steps>
  <Step title="Verify your account">
    Go to **Settings → Account Verification** and complete the business identity check. FraudEG requires this before activating live API access.
  </Step>

  <Step title="Retrieve your live API keys">
    Go to **Settings → API Keys** and copy your `feg_live_sk_...` and `feg_live_pk_...` keys. Store the secret key in your secrets manager — you will not be able to view it again after closing the modal.
  </Step>

  <Step title="Update your server configuration">
    Replace every instance of your sandbox secret key in your server environment variables and secrets manager with the live secret key. Leave your sandbox keys intact in any non-production environments you use for testing and development.
  </Step>

  <Step title="Configure production webhooks">
    Go to **Platform → Webhooks** and add your production webhook endpoint URL. Verify the endpoint by clicking **Send Test Event** — FraudEG will POST a `webhook.test` event and expect a `200` response within five seconds.
  </Step>

  <Step title="Enable risk rules and workflows">
    Review the rules and workflows you validated in sandbox. Toggle each one to **Enabled** in the production dashboard view. Confirm rule priority order before enabling.
  </Step>

  <Step title="Enable integrations">
    For each connected integration, ensure you have entered production credentials from the provider and toggled the integration to **Production** in **Platform → Integrations**.
  </Step>

  <Step title="Monitor your first live events">
    Watch **Platform → Events** and **Platform → Workflows → Execution Logs** closely during your first hour of live traffic. Verify that decisions, signals, and workflow actions match your expectations before scaling up volume.
  </Step>
</Steps>