Skip to main content

Environments & base URLs

DigiCert​​®​​ provides both production and demo environments across four geographic regions. Each API call starts with a region-specific hostname, followed by a predictable versioned path.

Tip

See Platform IP addresses and URLs for a complete list of protocols, hostnames, and IP addresses.

Region and hostname matrix

Make sure to use the appropriate hostname based on your regional requirements.

Notice

Add the clientauth. prefix to any of the above hostnames when you authenticate with a client certificate. For example, clientauth.demo.one.digicert.com. See Authentication for details on using mTLS.

Base URL pattern

Every DigiCert® ONE API follows this structure:

API endpoints by product

Working with environments

Start with demo

Demo is perfect for:

  • Integration development and testing.

  • Training new team members.

  • Validating workflows before production.

  • Load testing (within reason).

# Example: List certificates in Trust Lifecycle demo environment
curl -X GET \
  -H "x-api-key: YOUR_DEMO_KEY" \
  https://demo.one.digicert.com/mpki/api/v1/certificate-owners

Promote to production

When moving from demo to production, make sure you:

  • Create new credentials: Demo API keys don't work in production.

  • Update base URLs: Change only the hostname portion; demo.one.* to one.*. Paths stay identical.

  • Verify firewall rules: Your outbound IP list might differ between environments.

  • Test incrementally: Start with GET calls, then progress to POST/PUT once quotas and roles are validated.

# Demo environment
BASE_URL="https://demo.one.digicert.com"

# Production environment (only hostname changes)
BASE_URL="https://one.digicert.com"

# Your code stays the same
curl -X GET \
  -H "x-api-key: $API_KEY" \
  "$BASE_URL/account/api/v1/users"

Network considerations

IP allowlisting

If your infrastructure requires IP allowlisting, make sure you understand the following:

TLS requirements

  • Minimum TLS version: 1.2

  • Recommended: TLS 1.3

  • Required for mTLS: Valid client certificate chain

  • Certificate validation: DigiCert​​®​​ validates the full certificate chain

Self-hosted deployments

For on-premises or dedicated DigiCert instances:

  • Replace {hostname} with your custom FQDN (for example, pki.company.internal).

  • All path patterns remain identical.

  • The clientauth. prefix pattern still applies for mTLS.

API troubleshooting basics

Best practices

  • Monitor Release notes for platform updates and changes.

  • Always start with demo, even for simple integrations.

  • Use environment variables instead of hard-coded URLs or keys whenever possible.

  • Be aware of region-specific URLs.

In this section: