Environments & API Keys

Environments

Crossmint operates two fully separate environments:

Staging (staging.crossmint.com) — free, for development and testing, connected to blockchain testnets
Production (www.crossmint.com) — your live application, connected to mainnets, where real assets and real costs apply

The environments are isolated: each has its own console login, API keys, wallets, and orders. Build and test end-to-end in staging, then replicate the integration in production. See Staging vs Production for the full comparison.

Client-Side vs Server-Side API Keys

Checkout APIs accept both server-side and client-side API keys. Pick the one that matches where your requests originate.

Use a Server-Side Key When

Testing in the API Playground
Calling the API with cURL or scripts from your command line
Your application calls your own backend, which then calls Crossmint

The key consideration is whether the request comes from a server environment. A typical pattern is a Next.js route that forwards the order to Crossmint with x-api-key set to your sk_ key:

route.ts

const orderInput = {
    lineItems: [
        {
            tokenLocator: "solana:7EivYFyNfgGj8xbUymR7J4LuxUHLKRzpLaERHLvi7Dgu",
            executionParameters: { mode: "exact-in", amount: "1" },
        },
    ],
    payment: { method: "card", receiptEmail: "<buyer-email>" },
    recipient: { walletAddress: "<buyer-solana-wallet-address>" },
};

const res = await fetch("https://staging.crossmint.com/api/2022-06-09/orders", {
    method: "POST",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.CROSSMINT_SERVER_API_KEY, // sk_staging_...
    },
    body: JSON.stringify(orderInput),
});

Use a Client-Side Key When

Your application calls the Crossmint API directly from the browser or a mobile app

Client-side keys are restricted to authorized origins you configure when creating the key — add http://localhost:3000 (or your dev URL) while testing, or requests are denied. With a client-side key, the create-order response includes a clientSecret. Persist it and pass it as an authorization header on every subsequent request to edit or get the order:

const res = await fetch(`https://staging.crossmint.com/api/2022-06-09/orders/${orderId}`, {
    method: "GET",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.NEXT_PUBLIC_CROSSMINT_CLIENT_KEY, // ck_staging_...
        authorization: clientSecret, // saved from the create-order response
    },
});

Mobile Applications

Mobile apps using a client-side key must also send an x-app-identifier header with the bundle identifier (iOS) or package name (Android) whitelisted on the key:

x-app-identifier: com.yourcompany.yourapp

See Client-side API keys for setup.

API Keys

Create and scope server-side and client-side keys

Staging vs Production

The full environment comparison

Introduction

Quickstarts ⚡

Concepts

Guides

API Reference

Environments

Client-Side vs Server-Side API Keys

Use a Server-Side Key When

Use a Client-Side Key When

Mobile Applications

See Also

API Keys

Staging vs Production

​Environments

​Client-Side vs Server-Side API Keys

​Use a Server-Side Key When

​Use a Client-Side Key When

​Mobile Applications

​See Also

API Keys

Staging vs Production

Environments

Client-Side vs Server-Side API Keys

Use a Server-Side Key When

Use a Client-Side Key When

Mobile Applications

See Also