Sandbox test keys vs live production keys for the Partner API.
Partner API keys are issued in two environments: test (sandbox) and live (production). The key prefix (clfy_test_* or clfy_live_*) determines which environment your requests run in.
Behavior matrix
Test key (clfy_test_*) | Live key (clfy_live_*) | |
|---|---|---|
| Host | Works on staging and production hosts | Production (or staging with live data) |
| Data | Deterministic sandbox / fake payloads | Real tenant database |
| Mutations | Simulated IDs; no real ledger or payment rails | Real services; soft-delete + audit |
Portal X-Client-Id | Optional (fixtures) | Required |
When to use test
- Exploring the API and Postman collections
- CI smoke tests
- UI demos without touching real borrowers
When to use live
- Production partner integrations after UAT
- Real disbursements and repayments
- Webhook delivery against real events
Switching
- Keep separate keys for test and live. Never reuse a test secret in production code paths.
- Point the same base URL path at your tenant; only the key prefix changes behavior.
- Confirm environment via
GET /pingorGET /me(data.environment).
Going live checklist
- Complete flows with a test key.
- Generate a live key with minimal scopes.
- Update server-side config only.
- Monitor rate limits and audit logs.
- Rotate on a schedule or after staff changes.