Test & live modes
Every record carries a mode, derived from the authenticating credential — test and live data are fully isolated.
Every record in the system — payments, invoices, refunds, ledger entries,
webhooks — carries a mode of either TEST or LIVE.
| Mode | Behaviour |
|---|---|
TEST | Routes to the gateway sandbox. No real money moves. Excluded from financial reporting and reconciliation. |
LIVE | Routes to the production gateway. Real money moves. Included in all reporting and reconciliation. |
Mode comes from the credential, never the request
The mode of a request is derived from the credential that
authenticated it. A oi_test_… key always operates in TEST; a oi_live_… key
always in LIVE. There is no mode field you can set in a request body.
A test credential can never create, read, or affect live data, and vice versa. This isolation is enforced server-side on every query — it is not advisory.
This means you can integrate and test end to end against the sandbox with your test credentials, then switch to live purely by swapping the credential — no code path changes.
Webhooks carry the mode too
Delivered webhook envelopes include a mode field, and
test and live events are delivered independently. Branch on it if your consumer
handles both (for example, to route test events to a staging handler).