Environments

Vantrace environments use the same versioned endpoint path:

POST <base-url>/v1/engine/evaluate

The public documentation does not publish private environment addresses. Use the base URL supplied for your authorised environment.

Setting	Staging	Production
Base URL	Supplied for the integration	Supplied before production activation
API key	Environment-specific	Environment-specific
HMAC secret	Environment-specific	Environment-specific
Data	Synthetic test data only	Live transaction data

Store each environment’s values independently:

VANTRACE_BASE_URL=<base-url>
VANTRACE_API_KEY=<api-key>
VANTRACE_HMAC_SECRET=<hmac-secret>

Keep credentials out of code

Never place an API key or HMAC secret in source control, browser-side code, request logs, error messages, screenshots, or support messages. Store them in a server-side secrets manager.

Configuration rules

• Do not reuse staging credentials in production.
• Do not hard-code the base URL in settlement logic.
• Keep system clocks synchronised for the required X-Timestamp header.
• Rotate credentials through your approved secret-management process.
• Treat a leaked API key or HMAC secret as compromised immediately.