Environments
Base URLs, test and live keys, and the rate limits that apply.
Base URLs
| Environment | Base URL |
|---|---|
| Production | https://api.taxlyne.com/api/v1 |
| Staging | https://staging-e-invoice.harmonizedx.com/api/v1 |
Build against staging first. It runs the same code, usually a little ahead of production, against separate data — so nothing you do there reaches FIRS or a real customer.
Staging is sometimes ahead of production. An endpoint that answers on staging can
return 404 in production until the next release. If you are building against
something new, check it responds in production before you ship.
Test and live keys
Keys come in two types, and the type is visible in the key itself:
| Type | Looks like |
|---|---|
| Test | sk_test_… |
| Live | sk_live_… |
The type travels with the key, not with the environment — a test key on a production URL is still a test key.
A test key is not a sandbox for the whole API. Only creating, reading and deleting
an invoice are sandboxed. validate, sign and submit have no sandbox path — a
sk_test_ key calling POST /invoices/{id}/submit performs a real signature and a real
FIRS registration.
So a test key is safe for exploring invoice creation, and is not a safety net for filing. Never point filing calls at production with a key you believe to be harmless.
There is a second consequence. An invoice created with a test key lives in an in-memory
sandbox rather than the database, so its id does not resolve on the real path — calling
validate, sign or submit against it returns 404. A test key cannot walk an invoice
end to end.
To rehearse the full lifecycle, use a live key against staging, where the data is separate from production.
Rate limits
Two limits apply, independently:
| Limit | Scope | Window |
|---|---|---|
| 1,000 requests (default) | per API key | fixed hour |
| 100 requests | per IP address | rolling minute |
Exceeding the per-key limit returns 401 with Rate limit exceeded; exceeding the
per-IP limit returns 429. Both are worth handling — back off rather than looping.
The per-key window is fixed, not rolling: it opens on your first request and the counter resets an hour later, so a burst early in the window is not smoothed out.
The per-key limit is yours to set — pass rateLimit when you create the key
(1–100,000, default 1,000). The per-IP limit is fixed and applies to everyone.