> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Base URLs & environments

> Production and Sandbox base URLs of the Business API and its OAuth endpoints, and how to call the Sandbox.

The Business API is available in two environments: **Production** and **Sandbox** (dummy data, for testing). All the API operations can be replicated from the Sandbox to the Production environment; use the Sandbox base URLs, not the Production ones, while testing.

## Business endpoints

| Environment | Base URL | Example |
| - | - | - |
| Sandbox | `https://thirdparty-sandbox.staging.qonto.co` | `https://thirdparty-sandbox.staging.qonto.co/v2/internal_transfers` |
| Production | `https://thirdparty.qonto.com` | `https://thirdparty.qonto.com/v2/internal_transfers` |

## OAuth endpoints

| Environment | Base URL | Example |
| - | - | - |
| Sandbox | `https://oauth-sandbox.staging.qonto.co` | `https://oauth-sandbox.staging.qonto.co/oauth2/auth?client_id=XXXXXXX&redirect_uri=XXXXXX&response_type=code&state=1` |
| Production | `https://oauth.qonto.com` | `https://oauth.qonto.com/oauth2/auth?client_id=XXXXXXX&redirect_uri=XXXXXX&response_type=code&state=1` |

## Sandbox requests

Our entire **Sandbox / staging** environment is protected by a OneLogin gate and is **not directly accessible from the public internet**. For any **non-browser** call (cURL, your backend code, your HTTP client library, Postman, etc.), add the following header on every request you make to a Sandbox endpoint:

| Header | Value |
| - | - |
| `X-Qonto-Staging-Token` | your personal staging token |

When this header is present and valid, our infrastructure transparently bypasses the OneLogin gate and routes the request to the actual API.

> [!NOTE]
>
> The header name is **case-sensitive on the dash-separated capitalization shown above**: `X-Qonto-Staging-Token`. Lowercase or mixed variants may not be normalized by every layer in the chain.

> [!WARNING]
>
> The staging token is **Sandbox-only**: Production endpoints don't accept it.

**Where to find your staging token:** your staging token is available on the [**Developer Portal**](https://developers.qonto.com/), under your application's authentication credentials. It is personal to your application — do not share it.

The header must be present on **every** Sandbox request, including:

* **OAuth endpoints** (`/oauth2/auth`, `/oauth2/token`) — see [Testing in the Sandbox](https://docs.qonto.com/guides/authentication/oauth-sandbox.md)
* **Onboarding API** endpoints — see [Onboarding API authentication](https://docs.qonto.com/api-reference/onboarding-api/introduction/authentication.md)
* **Webhook subscription** endpoints — see [Test with webhook.site](https://docs.qonto.com/guides/webhooks/testing.md)
* **Embed dispatch** (proxy) endpoints — see [Proxy API requests from the Embed SDK](https://docs.qonto.com/guides/partner-mechanisms/encoded-requests.md)

To open a Sandbox URL in a **browser** (for example an Onboarding `redirection_link` or an attachment URL), the header can't be used: see [Accessing the Sandbox environment](https://docs.qonto.com/guides/developer-portal/sandbox-access.md#option-2-—-browser-calls-log-in-through-the-developer-portal-first).

### Example

```bash theme={null}
curl -X GET 'https://thirdparty-sandbox.staging.qonto.co/v2/bank_accounts' \
  -H 'Authorization: Bearer <your_access_token>' \
  -H 'X-Qonto-Staging-Token: <your_staging_token>'
```

To get access to the Sandbox and your credentials, see [Create my OAuth App](https://docs.qonto.com/guides/developer-portal/create-oauth-app.md) and [Set up the Sandbox environment](https://docs.qonto.com/guides/developer-portal/developer-guidelines.md#set-up-the-sandbox-environment).