---
title: "Environments"
description: "Flume has two environments, sandbox and live. They share one API and one set of docs, and differ in base URL, key prefix and who has access."
url: https://docs.tryflume.ai/concepts/environments
updated: 2026-11-11
---

# Environments

> Flume has two environments, sandbox and live. They share one API and one set of docs, and differ in base URL, key prefix and who has access.

Flume has two environments: **sandbox** for building and **live** for real users. The API, the iframe and these docs are the same in both. Only the values below differ.

| Property | Sandbox | Live |
|---|---|---|
| Base URL for server calls | `https://sandbox-api.tryflume.ai/partner/v1` | `https://ssapi.tryflume.ai/partner/v1` |
| Partner key starts with | `sk_dev_` | `sk_prod_` |
| User access token starts with | `ut_dev_` | `ut_prod_` |
| Iframe origin | The origin of the `iframe_url` you receive | The origin of the `iframe_url` you receive |
| Who can use it | Open to every partner with a sandbox key. | Early access. Not yet open to new partners; by request, one at a time. |
| How to get a key | By request: [Get a sandbox key](https://docs.tryflume.ai/get-a-key.md) | By request, after the [go-live checklist](https://docs.tryflume.ai/go-live.md) |
| Verification emails | Real email is sent | Real email is sent |
| Data | Separate keys, users and tokens | Separate keys, users and tokens |

## How do the docs show an environment?

- The **Sandbox / Live** switch in the header changes the host and the key prefixes in code samples.
- Your browser remembers the choice.
- Pages load with sandbox values. Copied samples are safe to run by default.
- Sentences and the table above never change. Only values in code do.
- The Markdown version of a page always has sandbox values.

## What is the same in both?

- Every path, header, field, error code and message type.
- The path prefix `/partner/v1`.
- The default [limits](https://docs.tryflume.ai/concepts/limits.md). Flume can set a different limit for one environment.

## What should you know about the sandbox?

- The sandbox has no test fixtures today:
  - no test users,
  - no fixed verification code,
  - no way to force a quote result.
- Verification sends a real email. Use an inbox you can read.
- A sandbox key and a sandbox user access token do not work on live.

## How do you get live access?

Live is in early access. Flume is not yet opening it to new partners, and will enable it by request, one partner at a time. Build and test in the sandbox, and do not plan a launch on live until Flume confirms your platform is enabled.

1. Finish the [go-live checklist](https://docs.tryflume.ai/go-live.md) in the sandbox.
2. [Ask Flume](https://docs.tryflume.ai/support.md#ask-for-live-access) for live access. Send your page origins, image hosts and redirect hosts.
3. Flume enables your platform on live and issues a live key.
4. Verify each user again on live. Sandbox tokens do not carry over.

A live key alone is not enough. Until Flume enables your platform, live refuses the key with `PARTNER_KEY_INVALID`.

> **Region:** Live accepts requests only from supported countries. A request from elsewhere gets a `403` with no JSON body, so it does not match the [error envelope](https://docs.tryflume.ai/api/errors.md). Tell Flume where your servers and your users are before you go live.

## What is the iframe origin?

The iframe's origin is the origin of the `iframe_url` that `POST /start-iframe-session` returns.

- Read it at run time: `new URL(iframe_url).origin`.
- Do not hardcode it. It differs between sandbox and live, and it can change.
- Your Content Security Policy needs it in `frame-src`. See [Security and CSP](https://docs.tryflume.ai/embed/security.md).
- The image links Flume returns can be on another origin again. Read that from a real link too.