Environments and access

Environments

Environment	Base URL	Use it for
Test	`https://test.unipay.co.zw`	Building and certifying your integration. Test data only — including a sandbox provider you can pay straight away.
Production	`https://online.unipay.co.zw`	Live payments, once you’ve completed the go-live checklist.

Each environment serves its own copy of these docs at /docs/. A change always reaches test before production; when the two differ, the docs on the environment you are calling are the ones that apply.

HTTPS only. Test and production are separate: credentials, organisations and data never cross between them.

Getting access

Axis Solutions onboards every partner. When your organisation is set up you receive:

API client credentials — a client_id and client_secret your server uses to get access tokens. See Authentication.
An administrator sign-in for the UniPay portal, for managing your organisation, credentials and users. It isn’t used by your integration code.
A service provider also receives its permanent provider number and four-character short code, which processors use to find it.

Managing credentials

Your administrator can create further credentials in the portal under API credentials, each with its own client_id (cred-…) and only the scopes it needs. Common patterns:

one credential per system or vendor that calls UniPay, so each can be revoked on its own;
a new credential for each rotation, so you can roll over without downtime: create the new one, deploy it, then revoke the old one.

From the same page you can regenerate a secret, disable a credential or revoke it:

A regenerated secret takes effect at once — the old secret stops working immediately. Tokens already issued stay valid until they expire (at most 30 minutes).
A disabled or revoked credential can’t get new tokens; the token endpoint answers access_denied.

Keep secrets in a secrets vault, never in source control or anything shipped to a device, and rotate them at least every 90 days.

Next: Test data, then the Quick start.