Environments and configuration

Sandbox and production

The OpenAPI contract intentionally uses placeholder servers so a developer cannot accidentally execute a financial request. LuxPay provisions the base URL, access credentials, available payment providers, currencies, and limits for each environment. Sandbox data must remain synthetic and must not be copied from production customers.

Centralized configuration

Define separate configuration values for API base URL, access token, webhook secret, and environment identifier. Add a startup guard that prevents sandbox credentials from being used against production and vice versa. Do not infer the environment only from the hostname; keep an explicit environment setting.

Capability differences

The services returned by GET /payment-services may differ between environments. Sandbox can also return simulated next actions rather than performing a real provider transaction. Your integration should consume API capabilities dynamically instead of assuming a provider or channel is always present.

Promotion gate

Before production, test registration and login, balance reads, retry-safe transfers, insufficient balance, hold and release, refunds, rate limiting, and duplicate webhook delivery. Record request IDs and outcomes. A successful front-end payment is not proof that settlement and reconciliation are complete.

Portal configuration

When deploying this portal, set NEXT_PUBLIC_API_BASE_URL and NEXT_PUBLIC_SANDBOX_API_BASE_URL to the approved hosts. Never put secrets in a NEXT_PUBLIC_* variable.