---
title: Environments
description: Sandbox and production hosts across Web & SDK, API, and Magic Link Mexico contracts.
canonical: https://developer.unico.io/dual-api/developers/api-reference/environments
locale: en
generated_by: markdown-export
---

### Hosts by contract

| Contract | Sandbox host | Production host |
|---|---|---|
| **OAuth2 / Token** | `https://identityhomolog.acesso.io` | `https://identity.acesso.io` |
| **Web & SDK** | `https://api.idcloud.uat.unico.app` | `https://api.idcloud.unico.app` |
| **API** | `https://api.id.uat.unico.app` | `https://api.id.unico.app` |
| **Magic Link (Mexico)** | `https://sandbox.trully.ai` | `https://api.trully.ai` |

### When to use sandbox

- Development and integration tests before production go-live.
- Validating new flows or capabilities your tenant is being enabled for.
- Reproducing customer-facing issues without affecting real data.

:::warning[Credentials are environment-specific]
Sandbox and production use **different credentials** (Client ID, private key, API key). Mixing credentials between environments is one of the most common causes of `401` errors. See [Authentication > Common errors](./authentication#error-codes).
:::

### Behavior differences

The two environments share the same API contract — same endpoints, same payloads. They differ in:

| Aspect | Sandbox | Production |
|---|---|---|
| **Credentials** | Sandbox-only | Production-only |
| **Real biometric data** | No (test data only) | Yes |
| **Webhook delivery** | Real (to your sandbox endpoint) | Real |
| **Rate limits** | Lower | See [Rate limits](./rate-limits) |
| **Persistence** | Periodically reset | Permanent |

### Webhook origins (Magic Link only)

If you use Magic Link (Mexico), allow the following origins on your webhook server's CORS:

- **Sandbox:** `https://verification.uat.unico.app`
- **Production:** `https://verification.unico.app`

### Hosts to allowlist for go-live

If your (or your client's) network requires an explicit firewall/proxy allowlist before going to production, request the following hosts:

- `cadastro.unico.app`
- `id.unico.io`
- `retry.unico.io`
- `ultimatum.unico.io`
- `backend-sdk.prod.private.unico.run`

If your firewall supports domain-level (wildcard) rules and you prefer fewer entries, you can allow these domains instead of the individual hosts above:

- `*.unico.app`
- `*.unico.io`
- `*.unico.run`

Beyond Unico's own domains, the following third-party hosts are essential to the product's
operation (feature-flag evaluation, error tracking, and performance monitoring) and must also be
allowlisted:

- `app.launchdarkly.com`
- `clientstream.launchdarkly.com`
- `events.launchdarkly.com`
- `o939397.ingest.sentry.io`
- `js-agent.newrelic.com`
- `bam.nr-data.net`

If your firewall supports domain-level (wildcard) rules, you can allow these domains instead:

- `*.launchdarkly.com`
- `*.sentry.io`
- `*.newrelic.com`
- `*.nr-data.net`