Base URL
There is a single base URL for both test and live traffic. There is no separate sandbox host.
| Environment | Base URL |
|---|---|
| All requests (test and live) | https://api.quatapay.com/api/v1 |
Test vs live
Test and live use the same host. What differs is the API key prefix and the create-payment path:
| Mode | Key prefix | Create-payment endpoint |
|---|---|---|
| Test | qpay_test_… | POST /api/v1/gateway/sandbox/payments |
| Live | qpay_live_… | POST /api/v1/gateway/payments |
The sandbox path mirrors the live API exactly — same request and response shape; only the path and key prefix differ. The live /gateway/payments endpoint rejects a test key with 403, and the sandbox path rejects a live key the same way.
Versioning
All endpoints are prefixed with /api/v1. We bump the version only on breaking changes; additive changes (new fields, new endpoints) happen in place. Deprecations get six months of notice on the changelog.
What differs in sandbox
- Wallets are pre-funded — fund/drain via the sandbox panel.
- No real money moves. Withdrawals settle to a simulated bank account.
- Webhooks fire on the same events as production, but you can replay them on demand.
TLS and IP allow-listing
We only accept TLS 1.2+ and reject HTTP. There is no IP allow-list on outbound calls to us — but you can pin our webhook source IPs (see the Webhooks doc for the current range).