XKOVA Docs
Docs / Start Here / Local Development

Local Development

XKOVA is hosted, so there is nothing to install or run locally. Developing your integration means pointing your own app at the hosted sandbox with a test key and building the way you normally would.

Point your app at the sandbox

The sandbox API, operator console, and demo tenant all run on XKOVA's side, so you only need two values to start: the sandbox base URL and a sandbox API key (xkv_test_ prefix, issued from the console under Settings). Keep the key server-side, in your environment config.

XKOVA_BASE_URL=https://sandbox-api.xkova.com/v1
XKOVA_API_KEY=xkv_test_...   # server-side only

The SDK takes the same two values; see the SDK Overview. Sandbox keys only work against the sandbox, so local work can't reach production.

Receive webhooks on your machine

XKOVA needs to reach your webhook endpoint, and a plain localhost URL isn't reachable from the internet. Two ways to develop the receiving side locally:

  • Test sends and replay. Register your endpoint in the console's Webhooks area, send a signed test event to it on demand, and replay any failed delivery. This covers most receiver development without extra tooling.
  • A public tunnel. To exercise live event flow end to end, expose your local receiver through a tunneling tool and register the tunnel URL as the endpoint.

Verify the signature on each delivery; the SDK ships a verifier. See Webhooks.

Test value and scenarios

  • Test tokens. Sandbox workspaces move test tokens funded from XKOVA-operated faucets; you enable them in the console at onboarding. No real funds are involved.
  • Screening scenarios. The sandbox screening provider is deterministic: specific inputs produce allow, review, and block outcomes, so you can exercise each compliance path. See Screening.
  • The demo tenant. A populated, periodically reset tenant for exploring the operator and member surfaces without building anything first. See Try the Demos.

A few habits that help

  • Send an Idempotency-Key on every write; a re-run of a crashed script won't double-create. See Idempotency.
  • The sandbox uses tighter rate limits than production, so you can build in back-off early. See Rate Limits.
  • Log the correlation_id from each response and webhook; it ties your logs to XKOVA's audit trail if you need support. See Errors.

Next

Follow the Quickstart to your first confirmed payment, or open Try the Demos to see both sides of the rails before you write code.