# Environments

Building with an AI agent? Start at https://docs.payme.io/agents.md

## Related

- [Test Cards and Payment Methods](/payments/getting-started/test-cards-and-payment-methods)
- [Authentication](/payments/getting-started/authentication)
- [Quickstart](/payments/getting-started/quickstart)
- [Errors](/payments/getting-started/errors)

## Base URLs

| Environment | Base URL |
|-------------|----------|
| Sandbox | `https://sandbox.payme.io/api/` |
| Production | `https://live.payme.io/api/` |

Point every request at the correct environment **with that environment's credentials**. Endpoint pages show both URLs. 

A full endpoint URL is the base URL plus the path, for example `https://sandbox.payme.io/api/generate-sale` and `https://live.payme.io/api/refund-sale`. 

Sandbox and production are separate accounts with separate credentials: a sandbox key is rejected by `live.payme.io` and vice versa. 

The sandbox is free and asks for no signatures. A test account cannot be converted into a live account. What works in the sandbox, and how to test what does not, is on [Test Cards and Payment Methods](/payments/getting-started/test-cards-and-payment-methods). 

### Other APIs

B2B Payments, Keep and Products & Customers document their hosts with their own APIs: [B2B Payments](/b2b-payments/contracts/overview#hosts-and-authentication), [Keep](/keep/partner-authorization/authorization-flow#base-url), [Products & Customers](/products-and-customers/authentication/hosts-authentication-and-errors#hosts).

## Hosts you will see besides the API

### The payment page (`sale_url`)

`generate-sale` returns a `sale_url` — the secured payment page to show the buyer.  It is the environment's host without `/api` (for example `https://sandbox.payme.io`) followed by `/sale/generate/<id>`, or `/sale/template/<id>` for template sales. 

**Use `sale_url` exactly as returned**; do not build it yourself or hard-code its host.

Examples on some pages show other hosts (for example `preprod.paymeservice.com`); never copy a host from an example into your code or allow-lists — read it from the response. 

### 3D Secure redirect pages

3D Secure redirect pages are served from a `paymeservice.com` address, for example `https://sandbox.paymeservice.com/3ds/redirect/<payme_sale_id>?pa=<code>`, not from `payme.io`. Allow-lists and Content Security Policies must include the host of the `redirect_url` you receive, or 3D Secure breaks. 

### Browser scripts

Load the Hosted Fields script from `cdn.payme.io`; its protected fields load in iframes from `hf.payme.io`. In the sandbox, a page whose policy set only `script-src https://cdn.payme.io` (plus what its own inline code needed) and `frame-src https://hf.payme.io` tokenized a card with no policy errors. The same files are also served from `cdn.paymeservice.com` (both hosts returned the identical Hosted Fields script on 2026-10-29), so if you load from there, allow-list that host instead.  The Apple Pay and Google Pay guides load `hostedfields.js` from `cdn.paymeservice.com`; the Hosted Fields guide shows `cdn.payme.io/hf/v1/hostedfields.js`. 

Load the Hosted Fields script from the URL given on the [Hosted Fields guide](/accepting-payments/checkout-and-in-person/hosted-fields-jsapi-guide); the same URL is used for sandbox and production, and `testMode` selects the environment. 

In browser code, sandbox vs production is chosen with `testMode` (default `false`): `PayMe.create(apiKey, { testMode: true })` for the sandbox. Setting it to `false` sends requests to production. 

## Testing in the sandbox

Use test data **only in the sandbox**. Test cards (including cards that force a decline), wallet cards, bank accounts and the values for creating test sellers are on [Test Cards and Payment Methods](/payments/getting-started/test-cards-and-payment-methods). 

### Merchant dashboard

`create-seller` returns a sign-up link to the merchant dashboard in `seller_dashboard_signup_link`. 

The test account is opened from the dashboard (click your name at the top → **Switch to test account**); where its keys are is on [Authentication](/payments/getting-started/authentication#getting-credentials). Test mode shows a white top bar and production a green one; switch back with your name → **Switch to live account**. Test sales appear in the test account's dashboard.