# Access and environments

Configure credentials, base URLs, and network access for sandbox and production.

Product: Payment API
Guides follow API reference 0.1.0 and event reference 0.1.0.
Canonical page: https://docs.axiym.io/payment-api/integration-guide/access-and-environments

Payment API access is provisioned per environment. Start in sandbox and request
production access when authentication, payout processing, webhooks, retries,
and reconciliation have been validated. The current Payment API accepts bank
destinations only.

The Payment API can list accessible Axiym accounts and their balances, but it
does not provide account-funding instructions or initiate funding. Use the
[Direct Trade API](/direct-trade-api) for account management and funding
instructions, then arrange for the account to be funded before confirming a
payment.

Listing an account does not establish payout eligibility. At confirmation,
the account must be active, payout-enabled, and sufficiently funded.

## What you provide

Give Axiym:

* the stable public egress IP addresses or CIDR ranges used to call the API.

## What Axiym provides

For each environment, Axiym provides:

* the Payment API base URL;
* OAuth `client_id` and `client_secret` values with the `PAYMENT` scope;
* confirmation that the calling egress addresses are allowlisted;
* the accounts, balances, and payout corridors available to your integration; and
* the sandbox party data, documents, outcome controls, and reset process
  available for testing.

Credentials and resources are not shared between sandbox and production.

## Resource access

Accounts, corridors, payouts, Payment Data Maps, and webhook subscriptions used
together must be accessible through the same integration credentials. Do not
combine identifiers from different integrations or environments.

## Environment endpoints

| Environment | Base URL                                      | API destination IP |
| ----------- | --------------------------------------------- | ------------------ |
| Sandbox     | `https://partner-api.sandbox.axiym.io/api/v1` | `35.244.214.3`     |
| Production  | `https://partner-api.axiym.io/api/v1`         | `34.160.126.192`   |

Call the API by hostname. The destination IP is supplied for partners whose
outbound firewall policy also requires an IP allowlist.

## Network allowlisting

Axiym accepts API requests only from allowlisted source addresses. A request
from another address returns `403 Forbidden`, even if the access token is
valid.

Confirm the actual public egress address from every calling runtime. Private
container or virtual-machine addresses are not the source address Axiym sees
after network address translation.

## Before production

* Configure production-specific credentials, resource identifiers, and base URLs.
* Confirm the production egress addresses are allowlisted.
* Configure the production webhook endpoint and signature verification.
* Confirm funded, payout-enabled accounts and available corridors with Axiym.

Complete the [production-ready checklist](/payment-api/integration-guide#production-ready-checklist)
before going live.