Environments and testing

The API is served from two hosts. Objects, keys, and balances never cross between them.

Both hosts terminate TLS. HTTP and non-TLS URLs are not supported.

Keys and hosts

Use a sandbox key only against the sandbox host, and a production key only against the production host. Sending rk_test_... to production (or rk_live_... to sandbox) returns 401 with code authentication_error.

Webhook endpoint secrets follow the same split: a whsec_ secret issued in sandbox does not verify production deliveries.

Sandbox

Sandbox is a full copy of the API for integration testing. Objects created in sandbox never affect production balances, cards, or cardholders.

Use sandbox to:

• Issue cards and wallet entities without moving live funds
• Exercise money-movement and dispute flows
• Register webhook endpoints and verify signatures (Rook-Signature,

Rook-Timestamp)

• Drive state with Sandbox simulation operations (POST /v1/simulate/...)

instead of waiting on networks or cardholders. The Sandbox section has an end-to-end walkthrough (wallet entity → application → wallet → card → authorize → clearing → statement).

Testing checklist

1. Create a sandbox API key (rk_test_...). 2. Call GET /v1/status and confirm status is OK, version matches this document, and timestamp is a current RFC 3339 instant. 3. Send X-Program-ID on program-scoped calls, or omit it if the sandbox organization has a single program. 4. Send an optional Idempotency-Key on POSTs that create a resource, change a resource lifecycle, or move money, and retry once to confirm the original payload is returned. 5. Verify a sandbox webhook delivery against the whsec_ secret before pointing a production endpoint at live traffic.