ROOK has two environments: Sandbox for testing and Production for real users. Each one is a separate portal address with its own credentials. A Client UUID and Secret Key generated in Sandbox will not authenticate against Production, even for the exact same Client. Every Client starts in Sandbox, and Production unlocks once your legal documents are signed.
If you are not sure how a Client relates to your account and your company, read What are accounts, organizations and Clients in ROOK? first.
What is the difference between ROOK Sandbox and Production?
Environment | Portal address | Purpose |
Sandbox |
| Build, test and debug your integration with real data sources against fake or limited data. Every new Client gets Sandbox. |
Production |
| Real users, real data. Unlocked once your agreements are signed and, if you contracted through the portal, once payment is set up. |
Each environment is its own portal address, not a toggle inside one page. The environment switcher in the header navigates you to the other environment's address.
How do I move my Client from Sandbox to Production?
Get your legal documents signed (Account → Legal) and, if you are contracting through the portal, activate a payment method and plan (Account → Billing). Once both are done, Production unlocks automatically and the ROOK Portal shows a "You're ready to go live!" modal offering to switch you over immediately.
Why does the ROOK Portal block an environment instead of showing the page?
If you open an environment your Client is not entitled to, or an environment that Client is not set up in, the dashboard shows a banner instead of the page: "This environment is not enabled for your account" or "This Client is not set up in this environment", with a button to jump to an environment that does work.
The ROOK Portal blocks the page because there is no active Client to address the request to. Refusing is the safe failure: it guarantees that every number you see on the dashboard belongs to the Client named in the sidebar.
What happens when my Sandbox free trial ends?
New Clients get a free trial in Sandbox. A banner in the header shows the days left, changing color as it counts down. When the Sandbox trial expires:
If Production is already active for your Client, nothing happens. The trial only gates Sandbox.
If Production is not active, the whole dashboard is replaced by a paywall ("Your free trial has ended") except the Billing section, so you can activate a plan. Nothing is deleted, and access comes back the moment a plan is active.
Which credentials exist in the ROOK Portal, and where do I find them?
Everything under Setup in the ROOK Portal is scoped to the Client and environment you have open right now. There is no global credential.
Credential | Where | Used for |
Client UUID | Setup → Credentials | Identifies your Client on every API call. |
Secret Key | Setup → Credentials | Authenticates your API calls. Paired with the Client UUID. |
SDK auth (Package Name / Bundle ID / Secret Word) | Setup → SDK Authentication | Only needed if you integrate a ROOK mobile SDK (Android, iOS, Flutter, Capacitor/Ionic, React Native). Skip it if you only use the API or webhooks. |
Webhook signing key | Setup → Webhook → Signature | Lets you verify the |
Webhook Basic Auth | Setup → Webhook → Basic Auth | Optional — only if your endpoint requires credentials to accept the delivery. |
For how the webhook signing key and Basic Auth are configured, see How do I set up webhooks in the ROOK Portal?.
What are the Client UUID and Secret Key?
Generate both in Setup → Credentials, in the environment you have open.
The Client UUID is always visible in the ROOK Portal.
The Secret Key is shown only once, at the moment you generate or regenerate it. ROOK does not store the Secret Key in a way that can be displayed again, so ROOK support cannot recover it either. A
.txtfile with both values downloads automatically the moment you generate a key, and that file is your only other copy — save it somewhere secure.
Never share your Secret Key in a support ticket, a chat, a screenshot or a public repository. If you need help, share the Client UUID and the environment. That is enough for ROOK to look into it.
How do I rotate or regenerate my Secret Key?
Go to Setup → Credentials and choose Request new token. Regenerating invalidates the previous Secret Key immediately. Anything still using the old key stops authenticating right away, with no grace period, so regenerate only when you are ready to update every service that uses it.
If a generation request fails partway, treat the previous Secret Key as compromised or unreliable and generate again rather than assuming the old key still works.
Do I need SDK authentication?
You need SDK authentication only if you use a ROOK mobile SDK. If you integrate through the ROOK API or receive webhooks only, skip Setup → SDK Authentication entirely.
SDK authentication is separate from the Client UUID and Secret Key, and has three fields:
Package Name (Android) and Bundle ID (iOS) — reverse-DNS format (
com.company.app).Secret Word — at least 8 characters. Like the Secret Key, the Secret Word is write-only: once saved it displays as dots, and you must re-enter it to make further changes.
Why don't my ROOK credentials work?
Check the environment badge in the header of the ROOK Portal first. The most common cause of a failed authentication is a Sandbox Client UUID and Secret Key used against Production, or the reverse. Credentials are generated and stored per environment, so always copy them from the environment you are integrating against.