Base URLs & environments

The Business API is available in two environments: Production and Sandbox (dummy data, for testing). All the API operations can be replicated from the Sandbox to the Production environment; use the Sandbox base URLs, not the Production ones, while testing.

Business endpoints

Environment	Base URL	Example
Sandbox	`https://thirdparty-sandbox.staging.qonto.co`	`https://thirdparty-sandbox.staging.qonto.co/v2/internal_transfers`
Production	`https://thirdparty.qonto.com`	`https://thirdparty.qonto.com/v2/internal_transfers`

OAuth endpoints

Environment	Base URL	Example
Sandbox	`https://oauth-sandbox.staging.qonto.co`	`https://oauth-sandbox.staging.qonto.co/oauth2/auth?client_id=XXXXXXX&redirect_uri=XXXXXX&response_type=code&state=1`
Production	`https://oauth.qonto.com`	`https://oauth.qonto.com/oauth2/auth?client_id=XXXXXXX&redirect_uri=XXXXXX&response_type=code&state=1`

Sandbox requests

Our entire Sandbox / staging environment is protected by a OneLogin gate and is not directly accessible from the public internet. For any non-browser call (cURL, your backend code, your HTTP client library, Postman, etc.), add the following header on every request you make to a Sandbox endpoint:

Header	Value
`X-Qonto-Staging-Token`	your personal staging token

When this header is present and valid, our infrastructure transparently bypasses the OneLogin gate and routes the request to the actual API.

The header name is case-sensitive on the dash-separated capitalization shown above: X-Qonto-Staging-Token. Lowercase or mixed variants may not be normalized by every layer in the chain.

The staging token is Sandbox-only: Production endpoints don’t accept it.

Where to find your staging token: your staging token is available on the Developer Portal, under your application’s authentication credentials. It is personal to your application — do not share it. The header must be present on every Sandbox request, including:

OAuth endpoints (/oauth2/auth, /oauth2/token) — see Testing in the Sandbox
Onboarding API endpoints — see Onboarding API authentication
Webhook subscription endpoints — see Test with webhook.site
Embed dispatch (proxy) endpoints — see Proxy API requests from the Embed SDK

To open a Sandbox URL in a browser (for example an Onboarding redirection_link or an attachment URL), the header can’t be used: see Accessing the Sandbox environment.

Example

curl -X GET 'https://thirdparty-sandbox.staging.qonto.co/v2/bank_accounts' \
  -H 'Authorization: Bearer <your_access_token>' \
  -H 'X-Qonto-Staging-Token: <your_staging_token>'

To get access to the Sandbox and your credentials, see Create my OAuth App and Set up the Sandbox environment.

Introduction

Authentication

Organization & accounts

Transactions & statements

Transfers

Getting paid

Cards

Invoicing

Spend management

Cash flow

Webhooks

Partner endpoints

Base URLs & environments

Business endpoints

OAuth endpoints

Sandbox requests

Example

​Business endpoints

​OAuth endpoints

​Sandbox requests

​Example

Business endpoints

OAuth endpoints

Sandbox requests

Example