Environments
Related
Base URLs
| Environment | Base URL |
|---|---|
| Sandbox | https://sandbox.payme.io/api/ |
| Production | https://live.payme.io/api/ |
Point every request at the correct environment with that environment's credentials. Endpoint pages show both URLs.
A full endpoint URL is the base URL plus the path, for example https://sandbox.payme.io/api/generate-sale and https://live.payme.io/api/refund-sale.
Sandbox and production are separate accounts with separate credentials: a sandbox key is rejected by live.payme.io and vice versa.
The sandbox is free and asks for no signatures. A test account cannot be converted into a live account. What works in the sandbox, and how to test what does not, is on Test Cards and Payment Methods.
Other APIs
B2B Payments, Keep and Products & Customers document their hosts with their own APIs: B2B Payments, Keep, Products & Customers.
Hosts you will see besides the API
The payment page (sale_url)
generate-sale returns a sale_url — the secured payment page to show the buyer. It is the environment's host without /api (for example https://sandbox.payme.io) followed by /sale/generate/<id>, or /sale/template/<id> for template sales.
Use sale_url exactly as returned; do not build it yourself or hard-code its host.
Examples on some pages show other hosts (for example preprod.paymeservice.com); never copy a host from an example into your code or allow-lists — read it from the response.
3D Secure redirect pages
3D Secure redirect pages are served from a paymeservice.com address, for example https://sandbox.paymeservice.com/3ds/redirect/<payme_sale_id>?pa=<code>, not from payme.io. Allow-lists and Content Security Policies must include the host of the redirect_url you receive, or 3D Secure breaks.
Browser scripts
Load the Hosted Fields script from cdn.payme.io; its protected fields load in iframes from hf.payme.io. In the sandbox, a page whose policy set only script-src https://cdn.payme.io (plus what its own inline code needed) and frame-src https://hf.payme.io tokenized a card with no policy errors. The same files are also served from cdn.paymeservice.com (both hosts returned the identical Hosted Fields script on 2026-10-29), so if you load from there, allow-list that host instead. The Apple Pay and Google Pay guides load hostedfields.js from cdn.paymeservice.com; the Hosted Fields guide shows cdn.payme.io/hf/v1/hostedfields.js.
Load the Hosted Fields script from the URL given on the Hosted Fields guide; the same URL is used for sandbox and production, and testMode selects the environment.
In browser code, sandbox vs production is chosen with testMode (default false): PayMe.create(apiKey, { testMode: true }) for the sandbox. Setting it to false sends requests to production.
Testing in the sandbox
Use test data only in the sandbox. Test cards (including cards that force a decline), wallet cards, bank accounts and the values for creating test sellers are on Test Cards and Payment Methods.
Merchant dashboard
create-seller returns a sign-up link to the merchant dashboard in seller_dashboard_signup_link.
The test account is opened from the dashboard (click your name at the top → Switch to test account); where its keys are is on Authentication. Test mode shows a white top bar and production a green one; switch back with your name → Switch to live account. Test sales appear in the test account's dashboard.