Environments & API Keys

Staging vs production, and when to use client-side or server-side API keys in Checkout

​

Environments

Crossmint operates two fully separate environments:

• Staging (staging.crossmint.com) — free, for development and testing, connected to blockchain testnets
• Production (www.crossmint.com) — your live application, connected to mainnets, where real assets and real costs apply

The environments are isolated: each has its own console login, API keys, wallets, and orders. Build and test end-to-end in staging, then replicate the integration in production. See Staging vs Production for the full comparison.

​

Client-Side vs Server-Side API Keys

Checkout APIs accept both server-side and client-side API keys. Pick the one that matches where your requests originate.

​

Use a Server-Side Key When

• Testing in the API Playground
• Calling the API with cURL or scripts from your command line
• Your application calls your own backend, which then calls Crossmint

The key consideration is whether the request comes from a server environment. A typical pattern is a Next.js route that forwards the order to Crossmint with x-api-key set to your sk_ key:

route.ts

const orderInput = {
    lineItems: [
        {
            tokenLocator: "solana:7EivYFyNfgGj8xbUymR7J4LuxUHLKRzpLaERHLvi7Dgu",
            executionParameters: { mode: "exact-in", amount: "1" },
        },
    ],
    payment: { method: "card", receiptEmail: "<buyer-email>" },
    recipient: { walletAddress: "<buyer-solana-wallet-address>" },
};

const res = await fetch("https://staging.crossmint.com/api/2022-06-09/orders", {
    method: "POST",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.CROSSMINT_SERVER_API_KEY, // sk_staging_...
    },
    body: JSON.stringify(orderInput),
});

​

Use a Client-Side Key When

• Your application calls the Crossmint API directly from the browser or a mobile app

Client-side keys are restricted to authorized origins you configure when creating the key — add http://localhost:3000 (or your dev URL) while testing, or requests are denied.

With a client-side key, the create-order response includes a clientSecret. Persist it and pass it as an authorization header on every subsequent request to edit or get the order:

const res = await fetch(`https://staging.crossmint.com/api/2022-06-09/orders/${orderId}`, {
    method: "GET",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.NEXT_PUBLIC_CROSSMINT_CLIENT_KEY, // ck_staging_...
        authorization: clientSecret, // saved from the create-order response
    },
});

​

Mobile Applications

Mobile apps using a client-side key must also send an x-app-identifier header with the bundle identifier (iOS) or package name (Android) whitelisted on the key:

x-app-identifier: com.yourcompany.yourapp

See Client-side API keys for setup.

​

See Also

API Keys

Create and scope server-side and client-side keys

Staging vs Production

The full environment comparison