> For the complete documentation index, see [llms.txt](https://docs.voveid.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.voveid.com/docs/setup-your-credentials.md).

# Environments and credentials

Understand VOVE ID environments, API keys, public keys, session tokens, and webhook secrets.

VOVE ID has two environments: Sandbox and Production. Credentials and resources belong to one environment and cannot be mixed.

## Environment URLs

| Service             | Sandbox                        | Production                     |
| ------------------- | ------------------------------ | ------------------------------ |
| Dashboard           | `https://dashboard.voveid.net` | `https://dashboard.voveid.com` |
| API                 | `https://api.voveid.net`       | `https://api.voveid.com`       |
| Hosted verification | `https://web.voveid.net`       | `https://web.voveid.com`       |

The hosted-flow `environment` query parameter is case-sensitive: use `Sandbox` with `.net` and `Production` with `.com`.

Use fictional identities, businesses, and documents in Sandbox.

## Credential types

| Credential             | Where it belongs                       | Purpose                                                | Typical lifetime         |
| ---------------------- | -------------------------------------- | ------------------------------------------------------ | ------------------------ |
| Private API key        | Backend only                           | Creates sessions/cases and retrieves protected results | Until rotated or revoked |
| Public SDK key         | Approved browser or mobile application | Initializes a VOVE ID SDK                              | Until rotated or revoked |
| Session token          | Intended client for one journey        | Starts a KYC verification                              | 30 minutes by default    |
| KYB case token         | Intended business applicant            | Opens one hosted KYB case                              | 24 hours                 |
| Webhook signing secret | Webhook server only                    | Verifies that a webhook came from VOVE ID              | Until endpoint rotation  |

## Obtain Sandbox credentials

1. Sign in to the Sandbox dashboard.
2. Open **General** under settings.
3. Copy the Sandbox API key into your server-side secret manager.
4. Copy the Sandbox public key into the approved client configuration.
5. Configure the relevant web domain, iOS bundle ID, or Android package ID.
6. Create a webhook endpoint and store its signing secret on the webhook server.

The private API key may appear visually masked. Treat it as a secret whether or not the dashboard is currently displaying it.

## Configure your server

Use environment variables or your deployment platform's secret manager:

```bash
VOVE_API_BASE_URL=https://api.voveid.net
VOVE_API_KEY=vove_sandbox_replace_me
VOVE_PUBLIC_KEY=public_sandbox_replace_me
VOVE_WEBHOOK_SECRET=webhook_secret_replace_me
```

Do not commit a real `.env` file. Do not expose `VOVE_API_KEY` or `VOVE_WEBHOOK_SECRET` through browser bundles, mobile resources, logs, analytics, screenshots, support tickets, or source maps.

## Use the correct credential

### Backend API request

```javascript
const response = await fetch('https://api.voveid.net/v2/sessions', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'x-api-key': process.env.VOVE_API_KEY,
  },
  body: JSON.stringify({ refId: 'customer-7f3d' }),
});
```

### Client SDK initialization

The client receives only the public key and a short-lived session token:

```javascript
const publicConfiguration = {
  publicKey: 'public_sandbox_replace_me',
  sessionToken: tokenReturnedByYourBackend,
};
```

## Rotation and revocation

Contact your VOVE ID Customer Success Manager or the support team to rotate or revoke an API key, public key, or webhook signing secret. If a credential may have been exposed, stop using it, remove it from logs or client code, and contact the team immediately.

After receiving a replacement, update your secret manager, deploy the consuming service, confirm the new credential works, and verify with VOVE ID that the old credential has been revoked.

## Production access

Contact your VOVE ID Customer Success Manager or email <contact@voveid.com> to request Production access. After access is provisioned, complete the [production checklist](/docs/production-readiness.md), verify allowlists, and repeat the complete session, SDK, webhook, and result-retrieval flow with Production credentials.