Environments & base URLs · LendEasy Docs

Use identical v1 contracts in an isolated Sandbox and Production environment, with separate credentials, data, callbacks, and money rails.

Sandbox exists so that every control you depend on in production is exercised before a real borrower is on the other end of it. That is why it shares the whole contract and simulates only the external effects — a test that passes against a different contract has proved nothing about the one you will ship on.

Four hosts, and only one of them moves money

Documentationhttps://docs.lendeasy.aiguides, recipes, generated API reference

OAuth token exchangehttps://auth.lendeasy.ai/oauth2/tokenclient-credentials issuance

Sandbox APIhttps://sandbox.api.lendeasy.aifictional data, simulated provider outcomes

Production APIhttps://api.lendeasy.ailive customer records, real money movement

Only the last of the four moves money, and a token for either API is refused by the other.

Every public resource is under /v1:

curl https://sandbox.api.lendeasy.ai/v1/loans/7204 \
  -H "Authorization: Bearer $TOKEN" \
  -H "LendEasy-Tenant: demo-lender"

Tenant IDs never appear in the host or path: the LendEasy-Tenant header is the only selector, and the issued token authorizes what the caller may do within it. The Servicing Workspace is the /v1/servicing namespace under the same base URL, not a separate host.

Sandbox simulates effects, never the contract

Sandbox preserves the implemented Production contract: resource state machines, validation, approval decisions, idempotency, event ordering, errors, and response fields are the same. Only external effects are simulated.

Use deterministic test controls supplied with your tenant to exercise outcomes such as:

ACH settlement, return, and cancellation windows;
card authorization, settlement, and chargeback;
payout approval, submission, settlement, and failure;
stale core facts, action timeouts, and reconciliation drift;
channel-gateway and voice-callback retry, duplicate delivery, and out-of-order delivery.

Sandbox clocks use real time unless your provisioned test tenant includes a controlled business-date fixture. Advancing a wall clock does not change a loan’s effective business date — so a test that moves the clock and expects a statement to cut will pass on your machine and silently never fire in Sandbox.

The same string can name two different resources

The two environments do not share credentials, IDs, idempotency records, customer data, provider configuration, webhook signing secrets, or generated artifacts. An identifier may coincidentally have the same text in both environments; it still names a different resource.

LifecycleEnvironment promotion

Sandbox buildcontract tests and fictional portfolio

Readiness reviewpermissions, callbacks, rails, reconciliation

Production pilotrestricted cohort and monitored limits

Scalewider products and automated controls

Promotion is not a URL swap

Promotion is configuration, but not merely a URL swap. Confirm all of the following:

Create dedicated Production OAuth clients with minimum scopes and named owners.
Configure Production channel gateways and voice callbacks with their signed or dispatch-bound authority.
Map real provider accounts and verify each supported rail end to end.
Set approval thresholds, actor roles, and emergency revocation procedures.
Validate business calendars, time zones, statement cutoffs, and product configuration.
Rehearse payment returns, funding failures, stale facts, and reconciliation repair.
Keep Sandbox and Production data pipelines, logs, secrets, and alert destinations separate.

Reject an unknown environment at start

Use environment variables and reject unknown environments at application start:

LENDEASY_ENV=sandbox
LENDEASY_BASE_URL=https://sandbox.api.lendeasy.ai
LENDEASY_CLIENT_ID=...
LENDEASY_CLIENT_SECRET=...

Use synthetic people, accounts, and documents in Sandbox. Do not send live personal information, bank credentials, or Production secrets into a non-production environment.