Back to Developer Portal
Orientation

Sandbox & credentials

This page covers Waffy's three environments, what you need in each, and how sandbox differs from production. Start in the sandbox.

Start here

Waffy runs three separate environments: sandbox (dev), staging and production. Each has its own accounts, organizations and API clients, and nothing is shared between them, so you register in every environment you use. Production moves real money, so build and test in the sandbox first.

  1. Register your organization in the sandbox business portal and create an API client there.
  2. Build and test your integration against the sandbox. The Quick start shows the first calls.
  3. Repeat in staging to check the setup end to end before go-live.
  4. Register in production when you are ready to go live. Production needs a compliance review and Waffy's readiness checklist.

Registered in production by mistake?

An organization created in production is a real production account and does not exist in the sandbox or staging. To test first, register again in the sandbox business portal. Contact Waffy if you need help.

What you need

  • Sandbox access: an isolated environment with its own users and contracts. Nothing in sandbox touches real money.
  • An API client: a client_id and a client_secret. Create it in the Waffy business portal under Settings, API clients. The secret is shown only once. Each environment has its own client. Once you are signed in to this site, the dashboard lists your clients and gives you a Postman environment for each.
  • Your organization admin's login: the same username and password as in the business portal. It is used to get the client admin token for contracts, settlement, balance and withdrawals.
  • A webhook signing secret: used to HMAC-verify inbound webhooks so you can trust the payload came from Waffy.
  • A pre-configured payment-method set: the subset of methods enabled on your org at onboarding (Mada, Visa, Mastercard, Apple Pay, STC Pay, Tabby, Tamara, Neo, manual bank transfer). The hosted checkout displays only the ones that are on for you.

Three kinds of token

Your client gives you an org token, and your admin login gives you a client admin token. A third value, the payment ticket, is requested by your backend for one buyer and one payment, right before the checkout redirect. See Authentication.

If you don't have these yet, register your organization in the business portal of the environment you are working in (the links are in the table below) and create an API client there. Reach out to your Waffy account manager if you need help.

Environments

AspectSandbox (dev)StagingProduction
Business portal (register here)portal-dev.waffyapp.comportal-stg.waffyapp.comportal.waffyapp.com
Developer portaldeveloper-dev.waffyapp.comdeveloper-stg.waffyapp.comdeveloper.waffyapp.com
Waffy ID (tokens)https://id-dev.waffyapp.comhttps://id-stg.waffyapp.comhttps://id.waffyapp.com
Business APIhttps://dev-api.waffyapp.comhttps://api-stg.waffyapp.comhttps://api.waffyapp.com
Authentication servicehttps://dev-auth.waffyapp.comhttps://auth-stg.waffyapp.comhttps://auth.waffyapp.com
Checkouthttps://external-dev.waffyapp.comhttps://external-stg.waffyapp.comhttps://external.waffyapp.com
Webhook URLSet by you: PATCH /api/clients/{client_id} with your client admin token (see the Webhooks API page).Same mechanism.Confirmed with Waffy before go-live.
PaymentsSimulated.Simulated or real.Real. Real money moves.
WebhooksFire on every state change, same payload shape.Same.Same.
Approval requiredNo.No.Yes: compliance review and Waffy’s readiness checklist.

Use the same code across all environments

The only thing that changes between environments is the base URLs and the credential set. Your request shapes, response schemas, and webhook payloads are identical. Keep the URLs in configuration, named like the Postman environment variables: id_base_url, api_base_url, auth_base_url and checkout_base_url. The Postman collection already works this way.
Org configuration