Sign in
Guides

Sandbox vs Production

Giftronaut provides two isolated environments. Build and test in Sandbox before promoting your integration to Production.

Environment comparison

FeatureSandboxProduction
Real chargesNo — balance is not deductedYes — balance is deducted
Gift cards redeemableNoYes
Emails deliveredNo (captured internally)Yes
Access token TTL24 hours1 hour
Rate limit300 req/min60 req/min

Single URL, credentials determine the environment

Both Sandbox and Production share the same base URL:

https://api.giftronaut.com/api/v1

The environment is determined entirely by the credentials you use to obtain your access token. Sandbox credentials route all requests to the Sandbox environment; Production credentials route requests to Production. No URL change is required when going live.

Do not mix Sandbox and Production credentials. The two environments maintain separate balances, orders, recipient data, and email templates.

Switching to Production

Each App in the developer portal is scoped to a specific environment. To go live, create a new App with the Production environment selected and obtain new credentials.

What that credential can do depends on how you call the API:

How you call usOAuth grantReady when?
MCP (Claude, Cursor, and other agents) authorization_code + PKCE Immediately — no approval needed
REST API from your own server client_credentials After server-to-server access is approved
A new production credential cannot issue client_credentials tokens yet. Requesting a token before approval fails with unauthorized_client. Sandbox credentials are enabled for client_credentials from the moment you create them, so this step is the one real difference when you go live.

Requesting server-to-server access

Open your production App in the developer portal and find the Server-to-server access section.

  1. Enter your IP allowlist. This is required — the request cannot be submitted without at least one address. List every server that will call the API, one CIDR per line (for example 203.0.113.10/32 for a single host, or 203.0.113.0/24 for a range). Requests from any other address are rejected with 403 once access is enabled, so include NAT gateways and any egress addresses your platform assigns.
  2. Submit the request. Our team reviews it and you are notified when it is approved. Until then the credential keeps working for MCP.
  3. Request a token. After approval, the Client Credentials flow works exactly as it does in Sandbox — same endpoint, same parameters.
Request it from the account that will be billed. Only the portal account that created the credential can request server-to-server access, because orders placed with it are charged to that account's balance. If a colleague should be billed instead, have them sign in and create their own production App — a credential cannot be transferred between accounts.

To add or change addresses later, edit the IP allowlist on the same App page. Keep it current: an expired or missing address is the most common cause of a sudden 403 in production.

Sandbox balance

Your Sandbox account is pre-loaded with a virtual balance of $10,000. If your balance falls below $1,000, it is automatically replenished to $10,000, so no manual funding is required. Balance deductions and refunds behave identically to Production — use the Balance API to inspect them.

Simulated email delivery

In Sandbox, gift card emails are not delivered to recipients. Orders complete immediately and the order status transitions to COMPLETE just as in Production, but no actual email is sent. Use this to verify your order flow end-to-end without needing real email addresses.

Testing tips

  • Use realistic test data — recipient names and emails follow the same validation rules as Production
  • Verify your idempotency key handling in Sandbox before going live
  • Test error paths: try submitting orders with invalid product IDs, amounts out of range, and missing fields
  • Check that your app handles 429 rate limit responses gracefully
  • Test cancellation flows using scheduled orders before testing immediate sends