Environments and keys

Environments

	Sandbox	Production
Purpose	Building and testing. Doesn't issue real protection.	Live orders.
API base URL	`https://api.sandbox.helloteak.com/v1`	`https://api.helloteak.com/v1`
Widget	`sandbox: true` in `configure`	`sandbox` omitted or `false`
Teak Dashboard	dashboard.sandbox.helloteak.com	Provided when you go live
Keys	Sandbox keys	Production keys
Status		status.helloteak.com

Keys only work in their own environment. Your Teak integration contact provides sandbox keys when you start, and production keys when you're ready to go live.

Your keys

You get a pair of keys for each environment:

Key	Format	Where it's used
Public key	`pk_...`	In the customer's browser, as the widget's `apiKey`. Safe to include in your pages.
Secret key	`sk_...`	On your server only. Exchanged, with the public key, for a short-lived access token. See Create an access token.

Keep your secret key on your server

Store it in a secret manager or environment variable. Don't put it in browser code, mobile apps, or source control. If it's exposed, contact your Teak integration contact to replace it.

If you're a platform that sells for several businesses, you also have partner keys, used only to create a client for each business. Each client has its own keys. See Onboard clients.

Authenticating API calls

Server-side API calls use a short-lived access token:

Call Create an access token with your public and secret keys.
Send the token on each call as Authorization: Bearer <token>.
Tokens expire 5 minutes after they're issued. When a call returns 401, get a new token and retry.

curl -X POST https://api.sandbox.helloteak.com/v1/auth/token \
  -H 'Content-Type: application/json' \
  -d '{"public_key": "pk_...", "secret_key": "sk_..."}'

{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }

The widget doesn't need a token: it authenticates with your public key.

Next steps

With your sandbox keys, you're ready to build:

Follow the integration guide step by step, from sandbox to live.
Learn how to handle errors from the Teak API, and when to retry.