> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crossmint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments & API Keys

> Staging vs production, and when to use client-side or server-side API keys in Checkout

## Environments

Crossmint operates two fully separate environments:

* **Staging** (`staging.crossmint.com`) — free, for development and testing, connected to blockchain testnets
* **Production** (`www.crossmint.com`) — your live application, connected to mainnets, where real assets and real costs apply

The environments are isolated: each has its own console login, API keys, wallets, and orders. Build and test end-to-end in staging, then replicate the integration in production. See [Staging vs Production](https://docs.crossmint.com/introduction/platform/staging-vs-production.md) for the full comparison.

## Client-Side vs Server-Side API Keys

Checkout APIs accept both server-side and client-side API keys. Pick the one that matches where your requests originate.

### Use a Server-Side Key When

* Testing in the [API Playground](https://docs.crossmint.com/api-reference/headless/create-order.md)
* Calling the API with cURL or scripts from your command line
* Your application calls your own backend, which then calls Crossmint

The key consideration is whether the request comes from a server environment. A typical pattern is a Next.js route that forwards the order to Crossmint with `x-api-key` set to your `sk_` key:

```typescript route.ts theme={null}
const orderInput = {
    lineItems: [
        {
            tokenLocator: "solana:7EivYFyNfgGj8xbUymR7J4LuxUHLKRzpLaERHLvi7Dgu",
            executionParameters: { mode: "exact-in", amount: "1" },
        },
    ],
    payment: { method: "card", receiptEmail: "<buyer-email>" },
    recipient: { walletAddress: "<buyer-solana-wallet-address>" },
};

const res = await fetch("https://staging.crossmint.com/api/2022-06-09/orders", {
    method: "POST",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.CROSSMINT_SERVER_API_KEY, // sk_staging_...
    },
    body: JSON.stringify(orderInput),
});
```

### Use a Client-Side Key When

* Your application calls the Crossmint API directly from the browser or a mobile app

Client-side keys are restricted to authorized origins you configure when creating the key — add `http://localhost:3000` (or your dev URL) while testing, or requests are denied.

With a client-side key, the create-order response includes a `clientSecret`. Persist it and pass it as an `authorization` header on every subsequent request to [edit](https://docs.crossmint.com/api-reference/headless/edit-order.md) or [get](https://docs.crossmint.com/api-reference/headless/get-order.md) the order:

```tsx theme={null}
const res = await fetch(`https://staging.crossmint.com/api/2022-06-09/orders/${orderId}`, {
    method: "GET",
    headers: {
        "content-type": "application/json",
        "x-api-key": process.env.NEXT_PUBLIC_CROSSMINT_CLIENT_KEY, // ck_staging_...
        authorization: clientSecret, // saved from the create-order response
    },
});
```

### Mobile Applications

Mobile apps using a client-side key must also send an `x-app-identifier` header with the bundle identifier (iOS) or package name (Android) whitelisted on the key:

```text theme={null}
x-app-identifier: com.yourcompany.yourapp
```

See [Client-side API keys](https://docs.crossmint.com/introduction/platform/api-keys/client-side.md#mobile-app-identifiers) for setup.

## See Also

> [card] [API Keys](https://docs.crossmint.com/introduction/platform/api-keys/overview.md)
>
> Create and scope server-side and client-side keys

> [card] [Staging vs Production](https://docs.crossmint.com/introduction/platform/staging-vs-production.md)
>
> The full environment comparison