Prerequisites and readiness

Readiness checklist

Complete these requirements in sandbox before writing integration code.

Requirement	Owner	Ready when
Merchant account and sandbox access	You and Bolt	You can sign in to the intended merchant account in sandbox
Custom Cart division and capabilities	Bolt	Bolt has confirmed the division and the capabilities required by your flow
Payment processor and currencies	Bolt	The processor accepts every currency you will test
Sandbox credentials	You	You have an API key, signing secret, and publishable key for the intended division
Trusted Domains for web	You	Every host that will open Bolt Checkout is registered

Merchant account and sandbox access

Sign in to the Sandbox Merchant Dashboard and select the merchant account you will use for development. If your company does not have a Bolt merchant account, start merchant onboarding.

Division and processor readiness

Custom Cart capabilities

Ask your Bolt onboarding or Customer Success contact to confirm that the division is configured for Custom Cart and has the capabilities your checkout will use:

Merchant Callbacks, including the Universal Merchant API if one URL will handle multiple events
Transaction webhooks
Split shipping and tax, if you will calculate them with separate callbacks
Pre-authorization order creation, if your flow requires it

There is no API-key-authenticated endpoint that reports the division's platform or enabled capabilities. Do not infer readiness from an API key or a working sandbox order.

Ask your Bolt onboarding contact to confirm that a payment processor is connected to the division and configured for every currency your storefront accepts. A connected processor is not necessarily configured for every purchase currency.

If order creation later returns currency_not_supported for a currency Bolt supports, ask Bolt to check the processor configuration before changing your cart.

Credentials and division ID

Follow API keys to obtain these values from Administration > API:

API key: Authenticates server requests.
Signing secret: Verifies Merchant Callback and transaction webhook requests.
Publishable key: Initializes the web or mobile client and identifies its division.

Keep the API key and signing secret in your backend secret manager. Do not put either secret in browser or mobile code.

Find your division ID

The division ID used by later callback and webhook requests is the second dot-separated segment of the publishable key:

Text

EXAMPLEKEY01.DIVISIONID01.0123456789abcdef0123456789abcdef
             ^^^^^^^^^^^^
             division ID

At this stage, confirm that all three credentials come from sandbox and that the publishable key identifies the intended division. You will verify registered callbacks and webhooks after configuring them in the later server integration guides.

Trusted Domains

For a web storefront, register every host that will open Bolt Checkout under Administration > Trusted Domains. Include staging hosts, CNAMEs, regional domains, and every production host.

Follow Register Trusted Domains for the dashboard steps. Register production domains before launch rather than relying on a checkout that works from a sandbox development host.

Environments and hostnames

Start in sandbox. Sandbox and production credentials, transactions, and client resources are separate.

Environment	Dashboard	API	Checkout scripts
Sandbox	`merchant-sandbox.boltapp.com`	`api-sandbox.boltapp.com`	`connect-sandbox.boltapp.com`
Production	`merchant.boltapp.com`	`api.boltapp.com`	`connect.boltapp.com`

See Environments for the complete environment reference.

When every checklist row is ready, create an order token in sandbox.