A complete guide to setting up sandbox and production environments.

Setting Up Sandbox and Production Environments

Every PetRock.cloud workspace includes two isolated environments: Sandbox and Production. Rocks, API keys, webhook subscriptions, and audit logs are scoped per environment.

Why separate environments?

Sandbox is intended for testing your integrations against the Rock API without affecting production rocks. While neither rock will perform any observable action, the audit log entries, webhook delivery attempts, and billing line items differ between environments.

Switching environments

The environment toggle is located in the top navigation bar, next to your workspace selector.

  1. Click the environment dropdown labeled Production or Sandbox.
  2. Select the desired environment.
  3. The dashboard reloads with that environment's rocks and configuration.

Note: API tokens are environment-specific. A sandbox token cannot be used to call production endpoints, and vice versa. The error returned will be 401 Unauthorized with the body {"error": "token_environment_mismatch"}.

API endpoint differences

Environment Base URL
Sandbox https://sandbox-api.petrock.cloud/v1
Production https://api.petrock.cloud/v1

All requests must include the appropriate token in the Authorization header.

Generating environment-scoped tokens

  1. Navigate to Settings → API Tokens.
  2. Confirm the environment indicator at the top of the page matches the environment you want to scope the token to.
  3. Click Generate Token.
  4. Provide a name and select a scope (read, write, or admin).
  5. Copy the token immediately. It will not be shown again.

Promoting configuration from sandbox to production

PetRock.cloud does not currently offer a one-click promotion flow. To promote configuration:

  1. In sandbox, navigate to Settings → Export Configuration.
  2. Download the resulting petrock.config.json file.
  3. Switch to production.
  4. Navigate to Settings → Import Configuration and upload the file.
  5. Review the diff carefully. Webhook secrets and API tokens are stripped during export and must be re-entered.

Differences in observable behavior

Both environments will produce identical observable rock behavior. This is by design. Use audit logs and webhook delivery records to verify that your integration code is firing correctly even when the rock itself does not respond.