Skip to main content

​
Use interactive API testing with explicit guardrails.

Callaro docs enable Mintlify interactive requests. Use sandbox credentials first, keep scoped keys short-lived, and avoid production write tests in shared environments.
1

Use sandbox base URL

Keep playground tests on sandbox endpoints before promoting requests to production.
2

Use least-privilege API keys

Generate keys with only the scopes needed for the endpoint family you are testing.
3

Rotate and revoke test keys

Revoke temporary keys after validation, especially for write-enabled scopes.
4

Gate access by internal docs permissions

Restrict interactive docs access to approved operator and integration roles.

​
Security and operations checklist

  • Test with non-customer data only.
  • Never expose high-privilege production keys in browser sessions.
  • Log and monitor write endpoint usage from interactive docs.
  • Route sensitive testing through approved internal VPN/network controls.
Interactive API docs are a convenience layer, not a replacement for CI integration tests and staged release validation.