Flume has two environments: sandbox for building and live for real users. The API, the iframe and these docs are the same in both. Only the values below differ.
| Property | Sandbox | Live |
|---|---|---|
| Base URL for server calls | https://sandbox-api.tryflume.ai/partner/v1 | https://ssapi.tryflume.ai/partner/v1 |
| Partner key starts with | sk_dev_ | sk_prod_ |
| User access token starts with | ut_dev_ | ut_prod_ |
| Iframe origin | The origin of the iframe_url you receive | The origin of the iframe_url you receive |
| Who can use it | Open to every partner with a sandbox key. | Early access. Not yet open to new partners; by request, one at a time. |
| How to get a key | By request: Get a sandbox key | By request, after the go-live checklist |
| Verification emails | Real email is sent | Real email is sent |
| Data | Separate keys, users and tokens | Separate keys, users and tokens |
How do the docs show an environment?
Section titled “How do the docs show an environment?”- The Sandbox / Live switch in the header changes the host and the key prefixes in code samples.
- Your browser remembers the choice.
- Pages load with sandbox values. Copied samples are safe to run by default.
- Sentences and the table above never change. Only values in code do.
- The Markdown version of a page always has sandbox values.
What is the same in both?
Section titled “What is the same in both?”- Every path, header, field, error code and message type.
- The path prefix
/partner/v1. - The default limits. Flume can set a different limit for one environment.
What should you know about the sandbox?
Section titled “What should you know about the sandbox?”- The sandbox has no test fixtures today:
- no test users,
- no fixed verification code,
- no way to force a quote result.
- Verification sends a real email. Use an inbox you can read.
- A sandbox key and a sandbox user access token do not work on live.
How do you get live access?
Section titled “How do you get live access?”Live is in early access. Flume is not yet opening it to new partners, and will enable it by request, one partner at a time. Build and test in the sandbox, and do not plan a launch on live until Flume confirms your platform is enabled.
- Finish the go-live checklist in the sandbox.
- Ask Flume for live access. Send your page origins, image hosts and redirect hosts.
- Flume enables your platform on live and issues a live key.
- Verify each user again on live. Sandbox tokens do not carry over.
A live key alone is not enough. Until Flume enables your platform, live refuses the key with PARTNER_KEY_INVALID.
What is the iframe origin?
Section titled “What is the iframe origin?”The iframe's origin is the origin of the iframe_url that POST /start-iframe-session returns.
- Read it at run time:
new URL(iframe_url).origin. - Do not hardcode it. It differs between sandbox and live, and it can change.
- Your Content Security Policy needs it in
frame-src. See Security and CSP. - The image links Flume returns can be on another origin again. Read that from a real link too.