Environments & Base URLs

Bead offers two runtime environments—Sandbox and Production—so you can develop safely and then move to live traffic with a simple base-URL switch.

Environment	Purpose	REST API base URL	OAuth token URL*	Notes
Sandbox	Functional testing, staging data, integration QA	https://api.test.devs.beadpay.io	https://identity.test.devs.beadpay.io/oauth/token	Lower rate limits; crypto endpoints settle to testnets; data wiped every 30 days.
Production	Live merchant traffic, real settlement	https://api.beadpay.io	https://identity.beadpay.io/oauth/token	Full monitoring & alerting; irreversible monetary movement.

*OAuth URLs assume you are using the client-credentials flow described in the Authentication guide.

Switching environments

1. Point your OAuth client at the matching token URL (sandbox vs. prod).

2. Change the API host in your HTTP client.

3. Keep all paths (/Merchants/..., /Locations/..., etc.) identical—no version suffixes or query toggles required.

# Sandbox example
export BEAD_API=https://api.test.devs.beadpay.io
export TOKEN_URL=https://identity.test.devs.beadpay.io/oauth/token

# Production example
# export BEAD_API=https://api.beadpay.io
# export TOKEN_URL=https://identity.beadpay.io/oauth/token

All SDK samples in this guide default to Sandbox. Replace the host strings to go live.

TLS & firewall rules

• Only HTTPS (TCP 443) is accepted; plain HTTP is rejected.

• Certificates use RSA-2048 and modern ciphersuites; minimum TLS 1.2.

• Outbound webhook IP ranges are published in the Webhook Event Reference page.

Environment-specific differences

Area	Sandbox	Production
Rate limits	2× higher burst allowance for fast QA	Stricter; can be raised per contract
Tender types	Includes test-only crypto networks	Mainnet and real card rails only
Data retention	Auto-purged after 180 days	Full audit history

Refer to each endpoint’s detail page for any additional caveats.

Next steps

• Obtain separate OAuth credentials for each environment.

• Whitelist the production IP ranges in your firewall before go-live.

• Review the Rate Limits & Throttling page to verify your integration handles 429 responses gracefully.