# API endpoints

The Checkout.com API is designed around REST principles:

- To interact with the API, perform an HTTP request to an endpoint.
- Endpoints are relative to the base URL.
- You must authenticate your request.
- If the endpoint requires you to provide data, you pass this as a JSON payload in the request body.
- Data in the response body is also sent as a JSON payload.
- Requests return a standard HTTP response code.

Base URLs are unique to each merchant and have two variants, depending on whether you perform the API call in the live or test environment:

- `https://{prefix}.api.checkout.com/{path}`
- `https://{prefix}.api.sandbox.checkout.com/{path}`
- `https://{prefix}.access.checkout.com/{path}`
- `https://{prefix}.access.sandbox.checkout.com/{path}`

> **Information**
>
> The unique API endpoint host names resolve to Checkout.com's [IP addresses](https://www.checkout.com/docs/developer-resources/ip-addresses.md). Do not allowlist these IP addresses.

You can perform test API calls in the sandbox environment without affecting live data.

The `{prefix}` value in the base URL is a string containing the first eight characters of your unique `client_id`, excluding the `cli_` prefix.

You can view your client ID in the Dashboard if you have the Account owner or Admin [user role](https://www.checkout.com/docs/business-operations/use-the-dashboard/manage-users/user-permissions.md#Pre-defined_roles).

To find your client ID:

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Select the Settings icon in the top navigation bar and open the Account structure tab.

The client ID is displayed in the top right corner of the tab.

> **Information**
>
> Your production and sandbox environments have different `client_id` values. If you are unsure of your client ID for either environment, contact your account manager or [request support](https://dashboard.checkout.com/support/new?topic=case_account_management_and_access&issue=issue_account_changes).

For example, if your client ID is `cli_vkuhvk4vjn2edkps7dfsq6emqm`, the base URL for your production environment is:

`https://vkuhvk4v.api.checkout.com/{path}`

The `{path}` value in the endpoint represents the resource from the [API](https://api-reference.checkout.com/). For example, `payments/{id}`.

> **Warning**
>
> You must use your Merchant Specific Sub-Domain (MSSD) base URL for all API requests. If you don't use your MSSD base URL, you receive a `403 Forbidden` status code, with an `error_type` of `base_url_invalid` in the response body.

All Checkout.com services use HTTPS to communicate and provide a certificate when you connect. The certificate allows your client to authenticate that we own the service you are connecting to.

> **Note**
>
> Do not pin certificates. We regularly renew and update certificates and pinning them will cause your integration to break after a certificate renewal.

- [TLS certificates](https://www.checkout.com/docs/developer-resources/api/api-endpoints/tls-certificates.md): Learn about the TLS certificate authorities required in your trust store when connecting to Checkout.com APIs.