How do I keep sandbox and production webhooks separate?

Baselayer applications are separate by design. Every organization has two applications, sandbox and production, each with its own API keys and its own set of webhook endpoints. An endpoint belongs to whichever application it was created under, and it only ever receives that application’s events. Sandbox activity cannot reach a production endpoint, and the reverse is also true.

In practice that means registering one endpoint for each environment. Endpoints created through the API with POST /webhooks attach to the application whose key you used, so a request made with a sand_ key creates a sandbox endpoint and one made with a prod_ key creates a production endpoint. The Webhooks tab in the console manages the production application’s endpoints.

Pointing both environments at one URL still works, since each endpoint has its own signing secret and can carry custom headers you can route on, but two URLs is simpler to reason about and keeps test traffic out of production handlers.