Start here

Every OrbitID team has two environments. They are fully separate: each has its own connections, directories, API keys, portal links, logs and product id.

Use the OrbitID Sandbox in development and Production in production. Follow https://orbitid.com/docs/environments.md

1. Read ORBITID_API_KEY and ORBITID_PRODUCT_ID per environment and add both to .env.example.
2. Fail at startup if production runs with an orb_test_ key, or development with orb_live_.
3. Keep every other OrbitID setting the same across environments.
4. List the env vars I need to set in each deploy target.

Sandbox

Use the Sandbox while you build. It has every feature of Production, including Admin Portal links, Directory Sync and webhooks, and is limited to 5 connections (SSO connections and directories combined). Sandbox connections work with real identity providers, so you can test against your own Okta or Entra ID tenant end to end.

The Sandbox is for building and testing, not for your customers' live sign-ins. It has its own SAML ACS URL and SP Entity ID, so an identity provider set up against the Sandbox only ever talks to the Sandbox. See the terms.

Production

Every new Production connection starts with a 7-day free trial. When the trial ends, the connection joins your subscription; without one it is switched off until you subscribe from Billing. Each connection is billed at $25 per month after its trial. See Billing.

Product id

Each environment has a product id. It is generated for you and shown on the environment's Configuration page. You use it:

• as the product half of client_id when you start a login (tenant=<tenant>&product=<product>),
• nowhere else: API requests authenticated with an environment key have their product set automatically.

Configuration page

The Configuration page also lists the values your customers' IT admins need when they set up their IdP:

• ACS URL: https://app.orbitid.com/api/oauth/saml in Production, https://app.orbitid.com/api/oauth/sandbox/saml in the Sandbox
• SP Entity ID: https://saml.orbitid.com in Production, https://saml.orbitid.com/sandbox in the Sandbox
• SP metadata: https://app.orbitid.com/.well-known/sp-metadata in Production. The Sandbox URL adds its ACS URL and SP Entity ID as query parameters, so copy it from the Sandbox Configuration page.
• Signing certificate: https://app.orbitid.com/.well-known/saml.cer
• OIDC callback URL: https://app.orbitid.com/api/oauth/oidc
• OAuth endpoints: authorize, token, userinfo and the OIDC discovery document
• SCIM base URL: https://app.orbitid.com/api/scim/v2.0

The SSO setup guides refer to these values.

Moving from Sandbox to Production

Nothing changes in your code except the API key and the product id. Create the customer's connection in Production (or send them a Production Admin Portal link), then start logins with the Production product id.

A SAML app set up against the Sandbox does not carry over: the customer's IT admin adds the Production ACS URL and SP Entity ID in their identity provider, which the Production Admin Portal walks them through.