Base URLs & environments

Onboarding endpoints

Environment	Base URL	Example
Sandbox	`https://thirdparty-sandbox.staging.qonto.co`	`https://thirdparty-sandbox.staging.qonto.co/register/registrations`
Production	`https://onboarding-partners.qonto.com`	`https://onboarding-partners.qonto.com/register/registrations`

The Sandbox host is shared with the Business API; the Production hosts differ (onboarding-partners.qonto.com here, thirdparty.qonto.com for the Business API).

Sandbox requests

Our entire Sandbox / staging environment is protected by a OneLogin gate and is not directly accessible from the public internet. For any non-browser call (cURL, your backend code, your HTTP client library, Postman, etc.), add the following header on every request you make to a Sandbox endpoint:

Header	Value
`X-Qonto-Staging-Token`	your personal staging token

When this header is present and valid, our infrastructure transparently bypasses the OneLogin gate and routes the request to the actual API.

The header name is case-sensitive on the dash-separated capitalization shown above: X-Qonto-Staging-Token. Lowercase or mixed variants may not be normalized by every layer in the chain.

The staging token is Sandbox-only: Production endpoints don’t accept it.

Where to find your staging token: your staging token is available on the Developer Portal, under your application’s authentication credentials. It is personal to your application — do not share it. The header must be present on every Sandbox request, including:

OAuth endpoints (/oauth2/auth, /oauth2/token) — see Testing in the Sandbox
Onboarding API endpoints — see Onboarding API authentication
Webhook subscription endpoints — see Test with webhook.site
Embed dispatch (proxy) endpoints — see Proxy API requests from the Embed SDK

To open a Sandbox URL in a browser (for example an Onboarding redirection_link or an attachment URL), the header can’t be used: see Accessing the Sandbox environment.

Example

curl -X GET 'https://thirdparty-sandbox.staging.qonto.co/register/registrations' \
  -H 'Authorization: Bearer <token>' \
  -H 'Qonto-Partner-Id: <partner_id>' \
  -H 'X-Qonto-Staging-Token: <your_staging_token>'

See Authentication for the headers required on every call.

Introduction

Registrations

Files

Partner events

Webhooks

Base URLs & environments

Onboarding endpoints

Sandbox requests

Example

​Onboarding endpoints

​Sandbox requests

​Example

Onboarding endpoints

Sandbox requests

Example