Move from sandbox to production

When your integration is ready for real users, switch from the Fiskil sandbox environment to production. This article covers the key differences between the two environments and the steps to go live.

Sandbox vs production

The sandbox environment uses Fiskil's mock data recipient and returns simulated data. It's designed for development and testing — no real consents are created and no real data holder connections are made. In Australia (CDR), that means no real CDR consents exist in sandbox.

Production uses your live API credentials and connects to real data holders. Real end users go through the actual consent flow with their bank or energy retailer.

Steps to go live

1. Complete the go-live checklist. Fiskil provides a go-live checklist in the Console covering security controls, your information security policy submission, and confirmation of your regulatory obligations. In Australia (CDR), this includes your CDR Representative obligations. All items must be completed before production access is granted. See the go-live security questionnaire for how to answer it well.
2. Review with Fiskil. After you complete the checklist, Fiskil's compliance and sales teams review the submitted details before approving go-live. You can book a meeting at the end of the security questionnaire in the Console.
3. Update your API base URL. Replace the sandbox base URL (https://sandbox.api.fiskil.com) with the production base URL (https://api.fiskil.com). All API calls, webhook endpoints, and Link SDK configurations must point to production.
4. Use production API credentials. Your sandbox API key isn't valid in production. Generate production credentials in the Console under API Keys, store them securely, and never commit them to source control.
5. Update the Link SDK configuration. If you use the Fiskil Link SDK for the consent UI, change the environment parameter from sandbox to production. Otherwise users will go through the mock consent flow instead of the real one.
6. Configure production webhook endpoints. Register your webhook URL in the production environment in the Console — webhook subscriptions are environment-specific, so sandbox subscriptions don't carry over.
7. Test with a real account. Connect a real bank or energy account end to end. Verify the consent flow completes, webhooks fire, and data is returned via the API.

Common issues when going live

• Test data appearing in production — check that both the Link SDK environment and the API base URL are set to production.
• API key rejected — confirm you're using the production key, not the sandbox one. Keys are displayed once in the Console; if lost, generate a new one.
• Webhook not firing — confirm the webhook URL is registered in the production Console (not sandbox) and that the endpoint is publicly accessible, not localhost.
• Consent flow not loading — verify the Link SDK is initialised with the production environment and your production client ID.

Still stuck? Contact support with your environment, endpoint, and any error payloads.