Live & Sandbox modes
Switch your merchant dashboard between real activity and a risk-free test environment
The merchant dashboard has two modes — Live and Sandbox — that share the same login but route to separate data stores. Toggling between them is instant and does not require a different URL.
Why two modes
Sandbox lets you and your team validate the integration end-to-end without touching production data:
- Trigger test payments using the simulator PSP — see Sandbox & test cards.
- Configure and replay webhook deliveries against a sandbox endpoint of your choice, with a sandbox-specific HMAC secret.
- Walk through new features with internal teams before exposing them to real customers.
Sandbox writes to an isolated database schema. Nothing produced in sandbox can affect live volumes, statistics, payouts, or invoices.
Switching modes
A toggle in the dashboard sidebar (next to your profile) flips the active mode. Every page that loads after the toggle reads from the corresponding environment.
The browser keeps you in the selected mode across tabs and reloads until you toggle again.
What's available in each mode
| Section | Live | Sandbox | Notes |
|---|---|---|---|
| Home | ✓ | — | Real account overview is hidden in sandbox. |
| Statistics | ✓ | — | Aggregated KPIs are meaningless on simulated traffic. |
| Transactions | ✓ | ✓ | Sandbox transactions are listed separately from live ones. |
| Customers | ✓ | ✓ | Sandbox customers are isolated from the live ledger. |
| Webhook logs | ✓ | ✓ | Each delivery is tagged with the environment that produced it. |
| eTerminal | ✓ | ✓ | The button opens the eTerminal on the matching host. |
| Configuration | ✓ | ✓ | Webhook endpoints and HMAC secrets are stored per mode. |
| My Exports | ✓ | — | Export jobs target live data only. |
| Finance | ✓ | — | Payouts, invoices, statements — live only. |
| Team | ✓ | — | Team membership is account-wide, managed in live. |
API keys and webhook secrets
Each mode has its own credentials:
- API keys prefixed
pk_live_...resolve only live PSP routes;pk_test_...keys resolve only the simulator. See Sandbox & test cards. - Webhook configurations are scoped per mode. A webhook endpoint added in sandbox does not receive live events, and vice-versa.
- Webhook HMAC secrets (
whsec_...) are independent per mode — rotating one leaves the other untouched.
When you wire up an integration, always confirm:
- The right API key matches the right mode in your deployment pipeline.
- The webhook endpoint registered in each mode is the one you intend to receive events from.
- Your verification logic uses the secret matching the active mode.
Going live
Once your sandbox integration checklist passes (see Sandbox), switching production traffic on is a credentials swap — no code change needed. Replace the test API key with the live one and the sandbox webhook secret with the live one.