Skip to main content
Stabyl exposes separate production and staging base URLs. API keys are environment-specific. Create staging API keys in the Stabyl staging app. Use those keys only with the staging API base URL. Production API access requires completed KYB and an explicit invitation from Stabyl. Staging access alone does not authorize production use. The invitation contains the instructions for provisioning production credentials.

KYB in Development and Staging

Every user is automatically KYB-approved in development and staging. This applies to login responses, KYB status, and REST/WebSocket trading admission. No KYB simulation call is required. Automatic approval does not change saved KYB applicant records, and simulated statuses do not override this environment policy. Production requires completed KYB and an explicit invitation as described above.

Request Conventions

Use query strings for GET filters and JSON bodies for POST, PUT, and PATCH operations that accept a body. Send all times in UTC. Treat amount fields as decimal strings.

Simulation

Simulation endpoints are non-production utilities. User-targeted requests may omit user_id with a valid API key or session cookie; unauthenticated requests must include it. A supplied ID must match the authenticated account, and signed API keys retain their request-signature requirements. They can create test deposits, test withdrawal records, test KYB states, and test product update notifications outside production. They are useful for end-to-end testing when you need deterministic activity without moving real funds.
Simulation withdrawals are testing records only. Production Partner API withdrawals require an explicitly enabled key and signed quote or submit request.

Environment Checklist

  • Use a staging key with https://api-staging.stabyl.com/v1.
  • Complete KYB and receive an explicit invitation from Stabyl before production onboarding.
  • After invitation, use the provisioned production key only with https://api.stabyl.com/v1.
  • Do not route simulation calls from production code.
  • Keep separate storage for staging and production cursors, order IDs, transaction IDs, and saved recipients.
  • Verify base URL and key environment before investigating authentication or access failures.