# Environments

Monetarie provides two isolated environments for integration.

## Production

| Attribute | Value |
|-----------|-------|
| **Base URL** | `https://api.monetarie.com` |
| **ISPB** | `46026562` |
| **Description** | Real transactions on SPI/BACEN. Actual financial transfers. |

```
https://api.monetarie.com/api/external/...
```

## Homologation

| Attribute | Value |
|-----------|-------|
| **Base URL** | `https://api-h.monetarie.com` |
| **ISPB** | `46026562` |
| **Description** | Testing environment with isolated data. Transactions do not affect real balances. |

```
https://api-h.monetarie.com/api/external/...
```
::: tip Homologation
Use the homologation environment to develop and test your integration before operating in production. Credentials are different between environments.
:::

## Credentials

Credentials (`client_id` and `client_secret`) are provided by your account manager during the onboarding process. Each environment has its own independent credentials.

::: warning Credentials are environment-specific
Homologation credentials do not work in production and vice versa. Never share your credentials with third parties.
:::

## Security

| Feature | Details |
|---------|---------|
| **Mandatory HTTPS** | TLS 1.2 or higher on all connections |
| **HSTS** | HTTP Strict Transport Security enabled |
| **AWS WAF** | Web application firewall protecting the API |
| **IP Whitelist** | Mandatory for each API Key |
| **HMAC-SHA512** | Per-request signature on transactional endpoints |

## Integration Requirements

- All requests must use **HTTPS**
- The API Key is permanent -- it does not expire. Configure IPs in the whitelist for security
- Transactional requests (cash-in, cash-out, refund, webhooks) require **HMAC-SHA512**
- Monetary values: **request** in centavos (R$ 1.00 = `100`), **response** in base units (R$ 1.00 = `10000`)
- Responses follow the `{"worked": true/false, ...}` pattern
- Never use floating point for monetary values -- always integers

## Rate Limiting

| Type | Limit |
|------|-------|
| Per IP (authenticated) | 90,000 requests/minute |
| Per IP (unauthenticated) | 5 requests/minute |
| Webhooks per account | Up to 5 URLs |

Rate limit headers in responses:

```
X-RateLimit-Limit: 60000
X-RateLimit-Remaining: 59997
Retry-After: 3  (only when 429)
```

::: tip Support
For integration questions, contact technical support through the channel provided in your contract.
:::