Use a configuration value for the base URL and load it alongside the matching secret. Refuse to boot if a
sk_live_ key is configured with a sandbox URL, or vice versa.
Never copy real personal identity numbers, bank details, API keys, or webhook secrets into sandbox. Use clearly synthetic values and mask examples so they cannot be mistaken for real customer records.