Sandbox vs production keys
Permissio runs sandbox and production on the same host. There is no separate sandbox.api.permissio.us. Both environments respond at:
https://api.permissio.us
The environment is selected by the API key prefix on each request:
| Prefix | Environment | Side effects |
|---|---|---|
sk_test_… | Sandbox | Test data, no billing, no real signing emails. |
sk_live_… | Production | Live identity, retention, and billing. |
Keys are not transferable. Sending an sk_test_… key on a request you intended to hit production will succeed — against sandbox. The server has no way to know your intent; it routes on the prefix.
Webhook payloads include "env": "sandbox" or "env": "production" so handlers can filter test traffic from live traffic on the same endpoint, if you choose to share endpoints between environments.