Sign in
Guides

Sandbox vs Production

Giftronaut provides two isolated environments. Build and test in Sandbox before promoting your integration to Production.

Giftronaut sandbox access is self-serve: sandbox credentials work the moment you create them. Every Giftronaut sandbox account starts with a $10,000 virtual balance. The Giftronaut sandbox uses the same base URL as Production, but its balance is virtual and no real gift cards are issued. Our sandbox environment is open and free to build on right away.

Environment comparison

FeatureSandboxProduction
Real chargesNo — only the virtual balance is deductedYes — balance is deducted
Gift cards redeemableNoYes
Emails deliveredNo (captured internally)Yes
Access token TTL24 hours1 hour
Rate limit300 req/min60 req/min

Single URL, credentials determine the environment

You can have separate credentials for Sandbox and Production. The Sandbox and Production environments use the same URL, and your credentials decide which one you call.

Sandbox environment: Same base URL as production, selected by sandbox credentials.

Both Sandbox and Production share the same base URL:

https://api.giftronaut.com/api/v1

The environment is determined entirely by the credentials you use to obtain your access token. Sandbox credentials route all requests to the Sandbox environment; Production credentials route requests to Production. No URL change is required when going live.

Do not mix Sandbox and Production credentials. The two environments maintain separate balances, orders, recipient data, and email templates.

Switching to Production

Each App in the developer portal is scoped to a specific environment. To go live, create a new App with the Production environment selected and obtain new credentials.

You should create a separate app for each environment. Before you begin building your integration, please confirm that your use case fits Giftronaut's compliance requirements. Giftronaut powers a wide range of use cases for digital rewards and incentives; however, some accounts may be restricted by Giftronaut's compliance requirements or its financial institutions.

Production access checklist: create a Production App, request server-to-server access with an IP allowlist, then request a token.

What that credential can do depends on how you call the API:

How you call usOAuth grantReady when?
MCP (Claude, Cursor, and other agents) authorization_code + PKCE Immediately — no approval needed
REST API from your own server client_credentials After server-to-server access is approved
A new production credential cannot issue client_credentials tokens yet. Requesting a token before approval fails with unauthorized_client. Sandbox credentials are enabled for client_credentials from the moment you create them, so this step is the one real difference when you go live.

Requesting server-to-server access

Giftronaut opens production server-to-server access after a Giftronaut team review. Giftronaut conducts a standard Know Your Business (KYB) review for all production accounts. Register a production app, request server-to-server access (typically enabled within 1 business day, following a Giftronaut team review). An IP allowlist is required for production server-to-server access.

IP allowlist — Limits production API calls to the servers you register.

Open your production App in the developer portal and find the Server-to-server access section.

  1. Enter your IP allowlist. This is required — the request cannot be submitted without at least one address. List every server that will call the API, one CIDR per line (for example 203.0.113.10/32 for a single host, or 203.0.113.0/24 for a range). Requests from any other address are rejected with 403 once access is enabled, so include NAT gateways and any egress addresses your platform assigns.
  2. Submit the request. Our team reviews it and you are notified when it is approved. Until then the credential keeps working for MCP.
  3. Request a token. After approval, the Client Credentials flow works exactly as it does in Sandbox — same endpoint, same parameters.
Request it from the account that will be billed. Only the portal account that created the credential can request server-to-server access, because orders placed with it are charged to that account's balance. If a colleague should be billed instead, have them sign in and create their own production App — a credential cannot be transferred between accounts.

To add or change addresses later, edit the IP allowlist on the same App page. Keep it current: an expired or missing address is the most common cause of a sudden 403 in production.

Sandbox balance

Virtual sandbox balance

When an order costs more than the remaining sandbox balance, the balance is automatically reset to $10,000 before the order is deducted, so no manual funding is required. Sandbox is Giftronaut's free test environment, with a $10,000 virtual balance for testing. You can use this balance to send test orders through the API. Balance deductions and refunds behave identically to Production — use the Balance API to inspect them.

Simulated email delivery

In Sandbox, gift card emails are not delivered to recipients. Orders complete immediately and the order status transitions to COMPLETE just as in Production, but no actual email is sent. Use this to verify your order flow end-to-end without needing real email addresses.

Testing tips

  • Use realistic test data — recipient names and emails follow the same validation rules as Production
  • Sandbox credentials do not work with MCP, which runs in Production only
  • Verify your idempotency key handling in Sandbox before going live
  • Test error paths: try submitting orders with invalid product IDs, amounts out of range, and missing fields
  • Check that your app handles 429 rate limit responses gracefully
  • Test cancellation flows using scheduled orders before testing immediate sends