Docs · updated 2 Nov 2026
Sandbox and Production
Your account is in Sandbox or in Production, and that, not your bot, decides where an execution goes. Sandbox fills it on paper and Decionis rules in shadow mode: nothing reaches a venue and no money moves. Production queues a live order and sends it only if Decionis, ruling in enforcement right before the venue, allows it. Every account starts in Sandbox.
Executions go where your account is: on paper in Sandbox, live in Production. Accounts start in Sandbox; an owner switches the account to Production in the console.
Side by side
| Sandbox | Production | |
|---|---|---|
| Funds | None: no live funds | Live: your account's own |
| Shadow intents (POST /machine/intents) | Ruled in shadow, never sent | Ruled in shadow, never sent |
| Executions (POST /machine/executions) | Filled on paper, in full, at the terms you stated | Queued, then sent to the venue with your own venue credentials |
| Decionis | Your strategy's policies and the runtime adapters policy rule in shadow mode | The same policies rule in enforcement right before the venue; each allow's single-use grant is claimed |
| When the ruling is not an allow | The paper fill still happens; would_execute says Production would not have placed it | Blocked with a reason; nothing is sent |
| Execution states | paper_filled | queued, prepared, sending, submitted, confirmed, or blocked |
| Receipt | None | One per confirmed execution |
| Keys that may execute | Any key with execute | Only keys with execute minted from a wallet sign-in |
| Licensed on | Every plan, including the free Developer plan | A paid plan: Usage, Starter, Team or Enterprise |
The same intent_key and terms return the first execution in either environment, so a retry after a timeout never places a second order. Read an execution back at GET /machine/executions/{id}; its environment field says where it went.
Sandbox: paper, with no live funds
- Nothing is signed, nothing reaches a venue and no money moves.
- Decionis still rules on every execution, in shadow mode, so each one tells you whether Production would have placed it: verdict, would_execute and the policies' reasons.
- The key's limits, the halt, replays and the observation's age are checked exactly as in Production, so a bot that runs cleanly here meets the same checks live.
- A paper fill never has a receipt: receipts prove what happened on a chain.
Production: live, with every gate enforcing
- Your bot's executions are always ruled in enforcement: under your strategy's policies and the runtime adapters policy, right before the order is sent. Anything but a claimed allow blocks it.
- The order goes out with your own venue credentials, and the strategy must be started in your console.
- The key's limits, your account's largest-order limit, its signing grants and its kill switch all apply. A halt stops every execution your bots asked for that has not been sent yet.
- If the account leaves Production while an execution is waiting, the execution is stopped before it is prepared or sent; it is never moved to paper.
- A key with execute minted from a password sign-in executes in Sandbox only. If the account is in Production, its executions are refused with key_minted_without_wallet, at intake and again before the order is prepared and sent. To make a key live, an owner mints it from the account console with a wallet sign-in.
Switching
- Run your bot in Sandbox until its rulings and paper fills look right. Your dashboard lists its latest rulings.
- On the free Developer plan, ask for a plan that licenses live funds from your dashboard (see Usage and licensing).
- Add a wallet: sign in to the account console at app.nevarn.com with the same email and password and create your wallet there. It joins the same account and keeps your keys and history.
- Re-mint your bots' execute keys from the console with your wallet sign-in: a key minted from a password sign-in stays in Sandbox. The Production readiness in the console lists every key that would be refused.
- An owner of the account switches it to Production in the console's settings. The switch asks the owner to sign again with the wallet, and every change is recorded.
Only an owner can switch, in either direction, and only from a wallet sign-in; an admin cannot, a password sign-in cannot, and no API key can. If your dashboard says the switch is not on yet, the deployment has not turned it on: every bot's executions stay in Sandbox until it does.
Reading your environment
GET /machine/mandate, with a read key, says under executions which environment your account's executions go to and the reading key's own execute limits. Read it at start-up rather than assuming: the account's owner may switch it at any time.