> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Base URLs & environments

> Production and Sandbox base URLs of the Onboarding Partners API, and how to call the Sandbox.

## Onboarding endpoints

| Environment | Base URL | Example |
| - | - | - |
| Sandbox | `https://thirdparty-sandbox.staging.qonto.co` | `https://thirdparty-sandbox.staging.qonto.co/register/registrations` |
| Production | `https://onboarding-partners.qonto.com` | `https://onboarding-partners.qonto.com/register/registrations` |

> [!NOTE]
>
> The Sandbox host is shared with the Business API; the Production hosts differ (`onboarding-partners.qonto.com` here, `thirdparty.qonto.com` for the [Business API](https://docs.qonto.com/api-reference/business-api/introduction/base-urls.md)).

## Sandbox requests

Our entire **Sandbox / staging** environment is protected by a OneLogin gate and is **not directly accessible from the public internet**. For any **non-browser** call (cURL, your backend code, your HTTP client library, Postman, etc.), add the following header on every request you make to a Sandbox endpoint:

| Header | Value |
| - | - |
| `X-Qonto-Staging-Token` | your personal staging token |

When this header is present and valid, our infrastructure transparently bypasses the OneLogin gate and routes the request to the actual API.

> [!NOTE]
>
> The header name is **case-sensitive on the dash-separated capitalization shown above**: `X-Qonto-Staging-Token`. Lowercase or mixed variants may not be normalized by every layer in the chain.

> [!WARNING]
>
> The staging token is **Sandbox-only**: Production endpoints don't accept it.

**Where to find your staging token:** your staging token is available on the [**Developer Portal**](https://developers.qonto.com/), under your application's authentication credentials. It is personal to your application — do not share it.

The header must be present on **every** Sandbox request, including:

* **OAuth endpoints** (`/oauth2/auth`, `/oauth2/token`) — see [Testing in the Sandbox](https://docs.qonto.com/guides/authentication/oauth-sandbox.md)
* **Onboarding API** endpoints — see [Onboarding API authentication](https://docs.qonto.com/api-reference/onboarding-api/introduction/authentication.md)
* **Webhook subscription** endpoints — see [Test with webhook.site](https://docs.qonto.com/guides/webhooks/testing.md)
* **Embed dispatch** (proxy) endpoints — see [Proxy API requests from the Embed SDK](https://docs.qonto.com/guides/partner-mechanisms/encoded-requests.md)

To open a Sandbox URL in a **browser** (for example an Onboarding `redirection_link` or an attachment URL), the header can't be used: see [Accessing the Sandbox environment](https://docs.qonto.com/guides/developer-portal/sandbox-access.md#option-2-—-browser-calls-log-in-through-the-developer-portal-first).

### Example

```bash theme={null}
curl -X GET 'https://thirdparty-sandbox.staging.qonto.co/register/registrations' \
  -H 'Authorization: Bearer <token>' \
  -H 'Qonto-Partner-Id: <partner_id>' \
  -H 'X-Qonto-Staging-Token: <your_staging_token>'
```

See [Authentication](https://docs.qonto.com/api-reference/onboarding-api/introduction/authentication.md) for the headers required on every call.