Environments
SignCare operates two public environments — Stage/UAT and Live/Production.
Stage (UAT) vs Live (Production)
| Property | Stage / UAT | Live / Production |
|---|---|---|
| Base URL | https://uat-ext.signcare.io | https://ext.signcare.io |
| Purpose | Integration testing, UAT, sandbox | Real customer traffic |
| Credentials | Stage-specific X-API-KEY + X-API-APP-ID | Separate Live X-API-KEY + X-API-APP-ID (issued at Go-Live) |
| Rate limits | Relaxed for testing | Per your commercial agreement |
| Provider mocks | Many endpoints return canned data | Real providers, real charges |
| Data retention | Non-production data may be purged | Full retention per agreement |
| Webhook deliveries | To your configured URLs | To your configured URLs |
| Support SLA | Best-effort during business hours | Per your commercial SLA |
Separate credentials per environment
Stage and Live use different X-API-KEY and X-API-APP-ID values. Stage credentials will not authenticate against ext.signcare.io, and vice versa. Treat your Live credentials like production secrets — store them in a secure secret manager, never in source control.
When switching from Stage to Live, both the base URL and the credential pair change:
- https://uat-ext.signcare.io/api/v1/pan/verify
- X-API-KEY: <stage-key>
- X-API-APP-ID: <stage-app-id>
+ https://ext.signcare.io/api/v1/pan/verify
+ X-API-KEY: <live-key>
+ X-API-APP-ID: <live-app-id>Live credentials are issued separately when you complete the Go-Live process. Until then, your Live key does not exist — only Stage works.
Recommended setup in your application
Drive both the base URL and the credential pair from environment variables so a single deploy can target either SignCare environment without code changes:
# .env.development
SIGNCARE_BASE_URL=https://uat-ext.signcare.io
SIGNCARE_API_KEY=<stage-key>
SIGNCARE_APP_ID=<stage-app-id>
# .env.production
SIGNCARE_BASE_URL=https://ext.signcare.io
SIGNCARE_API_KEY=<live-key>
SIGNCARE_APP_ID=<live-app-id>Example (Node.js):
const SIGNCARE_BASE_URL = process.env.SIGNCARE_BASE_URL;
const SIGNCARE_API_KEY = process.env.SIGNCARE_API_KEY;
const SIGNCARE_APP_ID = process.env.SIGNCARE_APP_ID;
async function verifyPan(pan) {
const res = await fetch(`${SIGNCARE_BASE_URL}/api/v1/pan/verify`, {
method: 'POST',
headers: {
'X-API-KEY': SIGNCARE_API_KEY,
'X-API-APP-ID': SIGNCARE_APP_ID,
'Content-Type': 'application/json'
},
body: JSON.stringify({ pan, consent: 'Y', consent_text: '...' })
});
return res.json();
}The same variable names work for both environments — only the values differ between deploys.
What's different between stage and live
In stage, some endpoints return mocked data for common test inputs (e.g. certain PAN/Aadhaar patterns). Production always hits the real provider. Ask your account manager for the list of mock inputs if you need them.
- Stage rate limits are relaxed — you can test without hitting 429s during development.
- Stage does not charge against your billing usage.
- Stage webhooks are delivered normally — use this to test your callback handlers.
- Stage does not guarantee data retention beyond 7 days.
Going live checklist
Before switching your production app to ext.signcare.io:
- ✅ Complete any Go-Live onboarding steps required for the APIs you use (some need upstream registration that takes weeks).
- ✅ Receive your Live
X-API-KEYandX-API-APP-IDfrom your account manager — they are different from Stage. - ✅ Store the Live credentials in your production secret manager (not in source control).
- ✅ Whitelist SignCare's webhook source IPs in your firewall (see Webhooks).
- ✅ Confirm your billing agreement covers expected volume.
- ✅ Verify you handle all documented error codes gracefully.
- ✅ Run a smoke test against Live with a small batch before full rollout.