> ## Documentation Index > Fetch the complete documentation index at: https://docs.sahlfinancial.com/llms.txt > Use this file to discover all available pages before exploring further. # Sandbox and production > One host, one key, an environment field. What the field changes and what it does not. There is one API host, `https://app.sahlfinancial.com/api`, and one kind of key. Each call says which environment it belongs to with the `environment` field: `sandbox` or `production`. The default is `sandbox`, so a call that forgets the field cannot touch production data. | Where | How you set it | | - | - | | `POST /v1/kyc/extract` | form field `environment` | | `POST /v1/kyc/verify`, `POST /v1/kyc/assess`, `POST /v1/kyc/eid` | JSON field `environment` | | `GET /v1/kyc/eid/{key}` | query parameter `environment` | Any other value is a 422. ## What the field changes | Item | Sandbox | Production | | - | - | - | | Cases | One case per workspace, environment and `reference`. | A separate case with the same `reference`. Nothing crosses between them. | | Documents, verdicts, eID records | Filed on the sandbox case. | Filed on the production case. | | Workspace KYC policy | The policy saved for (client kind, `sandbox`). | The policy saved for (client kind, `production`). Each environment can have its own thresholds and locks. | | Regime presets | A workspace under a regulatory regime with no saved policy gets its preset. For Canadian reporting entities the preset turns the Canadian screening **off** in sandbox. | Same preset with the Canadian screening **on**, because it is a billed service and test traffic should not reach it. Ask for it in sandbox with `canadian_screening: true`. | | Console views | Cases, Documents and the call log show the environment selected in the console top bar. | Production data in the console follows your plan: Free has 10 Production cases a month and needs a verified work email; paid plans get their quota. | | Webhook events | Sent, with `environment: "sandbox"` in the payload. | Sent, with `environment: "production"`. | | Raw files kept without a `reference` | Not filed on your workspace. | Not filed on your workspace. | ## What it does not change | Item | Detail | | - | - | | The reader | The same vision model reads sandbox and production files. Sandbox results are real reads, not canned data. | | Screening lists | The same sanctions lists. | | The read allowance | Sandbox and production reads count against the same monthly total (2,000 by default). | | Rate limit | 100 requests a minute per client IP, in both. | | eID | The eID provider is called for real, and emails the client, in both. `environment` only picks the case. | | API keys | One key works in both. | | Verdict rules | The same checks. Only the policy values can differ. | There are no magic test values and no canned test documents. The sandbox answers whatever you send, using the real engine. That means a fake document must still look like a document, and a fake client must not look like a specimen. ## Making a fake client that behaves | Do | Why | | - | - | | Use names such as `Test Client`. | A holder named exactly `John Doe`, `Jane Doe`, `Customer`, `Client`, `Sample`, `Example`, `Specimen`, `Test Card` or `Nom Prenom` is flagged as a template. | | Use an ID number that is not `P123456AA`, a run of one digit, or `123456789`. | Those are the numbers issuers print on specimens. | | Avoid `123 Any St` and a city named `City`, `Anytown` or `Ville`. | Same reason: template addresses. | | Do not write SPECIMEN, SAMPLE or VOID across the image. | The reader reports it and `authenticity:specimen:` fails, a critical check. | | Use a future expiry on IDs and a recent date on bills and statements. | `expiry:` and `recency:` are critical on those documents. | | Use a fake CIN such as `BK123456` (one or two letters, then five to seven digits) for a Moroccan client. For a Canadian client use a Luhn-valid but obviously fake SIN such as `123456782`, or no SIN. | `format:cin:` is a warning when a Moroccan CIN is malformed. `format:sin` is critical when a SIN fails its checksum. | ## Moving to production The calls are the same. What changes: 1. Send `environment: "production"`. 2. Make sure a KYC policy exists for production if you want one. Without it the regime preset or default applies. See the [go-live checklist](/go-live). 3. Check your plan's Production allowance. Free includes 10 Production cases a month and needs a verified work email (not Gmail or Yahoo); Sandbox is unlimited on every plan. Real client documents belong in production only. ## Data kept in sandbox * With a `reference`, the files, the read fields and the checks are stored on your sandbox case, where your staff see them. * Without a `reference`, nothing is filed on your workspace. Ask Sahl before sending anything sensitive. ## Limits Up to 5 files per `extract` call, 30 MB per file by default, 2,000 document reads a month by default, 100 requests a minute per IP. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.