Environments

Hosts by contract

Contract	Sandbox host	Production host
OAuth2 / Token	https://identityhomolog.acesso.io	https://identity.acesso.io
Web & SDK	https://api.idcloud.uat.unico.app	https://api.idcloud.unico.app
API	https://api.id.uat.unico.app	https://api.id.unico.app
Magic Link (Mexico)	https://sandbox.trully.ai	https://api.trully.ai

When to use sandbox

• Development and integration tests before production go-live.
• Validating new flows or capabilities your tenant is being enabled for.
• Reproducing customer-facing issues without affecting real data.

Credentials are environment-specific

Sandbox and production use different credentials (Client ID, private key, API key). Mixing credentials between environments is one of the most common causes of 401 errors. See Authentication > Common errors.

Behavior differences

The two environments share the same API contract — same endpoints, same payloads. They differ in:

Aspect	Sandbox	Production
Credentials	Sandbox-only	Production-only
Real biometric data	No (test data only)	Yes
Webhook delivery	Real (to your sandbox endpoint)	Real
Rate limits	Lower	See Rate limits
Persistence	Periodically reset	Permanent

Webhook origins (Magic Link only)

If you use Magic Link (Mexico), allow the following origins on your webhook server's CORS:

• Sandbox: https://verification.uat.unico.app
• Production: https://verification.unico.app

Hosts to allowlist for go-live

If your (or your client's) network requires an explicit firewall/proxy allowlist before going to production, request the following hosts:

• cadastro.unico.app
• id.unico.io
• retry.unico.io
• ultimatum.unico.io
• backend-sdk.prod.private.unico.run

If your firewall supports domain-level (wildcard) rules and you prefer fewer entries, you can allow these domains instead of the individual hosts above:

• *.unico.app
• *.unico.io
• *.unico.run

Beyond Unico's own domains, the following third-party hosts are essential to the product's operation (feature-flag evaluation, error tracking, and performance monitoring) and must also be allowlisted:

• app.launchdarkly.com
• clientstream.launchdarkly.com
• events.launchdarkly.com
• o939397.ingest.sentry.io
• js-agent.newrelic.com
• bam.nr-data.net

If your firewall supports domain-level (wildcard) rules, you can allow these domains instead:

• *.launchdarkly.com
• *.sentry.io
• *.newrelic.com
• *.nr-data.net