Environments and Keys

Guapocado separates environments with API keys.

Customer integrations call the same API origin:

https://api.guapocado.dev

The key decides whether the request hits sandbox or production state.

Sandbox

Use sandbox for:

• development
• test checkout
• example apps
• webhook receiver testing
• config changes before production

Sandbox keys normally contain test-mode prefixes:

sk_guap_test_...
ck_guap_test_...

Production

Use production for real customers and real billing.

Production keys normally contain live-mode prefixes:

sk_guap_live_...
ck_guap_live_...

Push live config intentionally:

npx guap plan --live
npx guap push --live

Server Keys

Server keys start with sk_guap_.

They are for trusted backend code and can:

• create customers
• create checkout sessions
• read entitlements
• consume and refund usage
• configure usage overage
• configure limit expansion
• change subscriptions
• register webhook receivers

Never put a server key in browser code.

Client Keys

Client keys start with ck_guap_.

They are for browser-safe reads and can:

• check feature access
• read usage balance
• read effective limits

Client keys cannot start checkout, consume usage, or mutate customer state.

Staging

Guapocado may use staging internally, but end-user integrations should not need a staging API target. For customer integrations, choose sandbox or production by using the right key.

Local Development

Typical local server env:

GUAPOCADO_API_KEY=sk_guap_test_...

Typical browser env:

VITE_GUAPOCADO_CLIENT_KEY=ck_guap_test_...

Next.js client env:

NEXT_PUBLIC_GUAPOCADO_CLIENT_KEY=ck_guap_test_...

Keep server keys out of NEXT_PUBLIC_, VITE_, and any other client-exposed environment variables.