Copy page

API basics

Environments

SoftLemon provides a sandbox for development and testing and a production environment for live traffic.

Environment	Base URL	Purpose
Sandbox	https://api.sandbox.softlemons.com	Integration development and testing. No real money moves.
Production	Provided by the SoftLemon team together with your production keys.	Live traffic.

Both environments expose the same API surface. All examples in this documentation run against the sandbox.

API keys

Keys are environment specific. A sandbox key never works in production and a production key never works in the sandbox.

Accounts and API keys are provisioned by the SoftLemon team. There is no self-service signup. To get sandbox access or to request production keys, contact support.

Send your key on every request:

Shell
curl https://api.sandbox.softlemons.com/api/v1/key-info \
  --header 'Authorization: Bearer {YOUR_API_KEY}'

Two endpoints help you verify a key:

• POST /validate-key checks whether a key is valid without authenticating a full request.
• GET /api/v1/key-info returns the key's metadata, including the entity it belongs to and its permissions.

A missing or invalid key returns HTTP 401 with code ERR_AUTH_FAILED. A valid key on a deactivated account returns HTTP 403 with the same code. See error handling.

Sandbox testing

Use the 3D Secure test cards listed in the Merchant API reference to exercise frictionless, challenge and failure outcomes. Webhook deliveries, duplicate protection and rate limits all behave the same as production.

Go-live checklist

Before switching live traffic on:

1. Swap the base URL to production and replace sandbox keys with production keys. Never hardcode keys, load them from configuration.
2. Confirm your webhook endpoint is reachable from the internet over HTTPS and your stored signing secret is the production one. See the webhooks guide.
3. Verify your error handling matches on code values, not on message text or HTTP status alone.
4. Confirm your duplicate protection strategy sends a unique reference per payment attempt. See the duplicate protection guide.
5. Review the rate limits against your expected peak volume.
6. Run one low-value live transaction end to end, including capture and refund, before opening real traffic.

Production onboarding, including any compliance checks required before go-live, is walked through with the SoftLemon team. Contact support to start it.