> For the complete documentation index, see [llms.txt](https://doc.youverify.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.youverify.co/get-started/authentication-and-environments.md).

# Authentication and Environments

Cowork provides separate sandbox and production (live) environments, each with its own base
URL and credentials shown in the workspace. Sandbox uses test data and is not billed; production 
runs real checks against authoritative sources and is billed. Never use a sandbox key against production
or vice versa.

Authentication is a single header on every server-to-server request. There is no separate OAuth 
handshake; possession of the secret key is authority, so it must never leave your backend.

| Credential          | Where used                                                            | Notes                                                           |
| ------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------- |
| API secret key      | Server-to-server, <mark style="color:$primary;">`token`</mark> header | Never expose client-side. Authority = possession.               |
| Public merchant key | Web/mobile SDKs, hosted flows                                         | Client-safe; scoped to liveness/document-capture session start. |

<table><thead><tr><th width="177.3447265625">Environment</th><th width="180.8544921875">Baseurl</th><th>Purpose</th><th>Data</th></tr></thead><tbody><tr><td>Sandbox</td><td>https://api.sandbox.youverify.co</td><td>Integration &#x26; testing</td><td>Test data, not billed</td></tr><tr><td>Production (live)</td><td>https://api.youverify.co</td><td>Real checks</td><td>Authoritative sources, billed</td></tr></tbody></table>

#### API conventions

• Format: JSON over HTTPS on every request and response.

• Identifiers: entities carry a stable ent\_… ID; other objects carry their own IDs.

• Response envelope: every response shares one shape, so you write your client once. { "success": true, "status\_code": 200, "message": "…", "data": { }, "links": \[] }

• Errors: same skeleton with success: false, a statusCode, and a machine-readable name (e.g. ResourceNotFoundError).

• Pagination: list endpoints support offset paging; high-volume streams (for example signals) also offer cursor pagination, preferred for production polling.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://doc.youverify.co/get-started/authentication-and-environments.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.