Environments
StudentPay runs fully isolated sandbox and production Developer Platform environments.
| Sandbox | Production | |
|---|---|---|
| Base URL | https://sandbox-api.studentpay.com.au |
https://api.studentpay.com.au |
| v1 root | https://sandbox-api.studentpay.com.au/v1 |
https://api.studentpay.com.au/v1 |
| Pinch | /test only |
/live only |
| Salesforce | Developer sandbox org | Production org |
| API keys | Sandbox-only keys | Production-only keys |
Discovery
GET /v1/environment
Returns non-secret metadata and a readiness report (missing variable names only — never secret values).
In the API Reference, switch the server dropdown between Sandbox and Production before trying requests.
Isolation rules
- Do not reuse production secrets in sandbox (or the reverse)
- Sandbox Pinch calls are forced to
/test - Sandbox refuses production Salesforce login URLs
- Missing credentials fail closed — they are never replaced with the other environment’s values
Wizard hosts
Browser-based enrolment wizards should allowlist their origin via ALLOWED_ORIGINS on the StudentPay deployment. DDA setup links are minted from the active API base URL (for example https://sandbox-api.studentpay.com.au/api/dd-setup).