Environments & credentials

	Sandbox	Production
Purpose	Build + test your integration end-to-end	Live borrower data
Accepts	Test keys only (pk_…_test_…)	Live keys only (pk_…_live_…)
Data	Test cases, simulated partners	Real cases, real field partners
Signature debugger	/debug/echo-signature available	Not available (by design)
Base URL	https://alpha-gig.quikkred.in	https://gig.quikkred.in

The environment split is enforced by the servers, not by convention — a test key presented to production is rejected with 401, and vice versa. There is no way to accidentally point a test integration at live data.

Credential model

Your credential has two parts:

• apiKeyId — public identifier, sent as the Bearer token. Identifies your organisation; safe to log.
• hmacSecret — never transmitted. Proves possession by signing every request and verifies the webhooks we send you. Store only in your secrets manager.

Both sandbox and production get their own independent pair.

Operational properties

Property	Behaviour
Rotation	Zero-downtime: a new secret is issued while the old stays valid until you confirm cutover.
Revocation	Effective within 60 seconds.
Brute-force lockout	Repeated invalid signatures soft-lock the key for 15 minutes (429 AUTH_LOCKED) and alert both sides.
Rate limits	Default 60 requests/min and 10 case-batches/hour per organisation — see errors & rate limits.
IP allowlist	Optional — your keys can be restricted to your egress IPs.