---
title: "API clients and SDKs: keep example addresses out"
description: "Why api.example-petstore.com returns 410 Gone, how to keep base URLs in configuration, and how to stop example addresses reaching production."
url: https://example-petstore.com/guides/api-base-url
language: en
---

# Configuring API clients and SDKs

Requests to addresses such as api.example-petstore.com come from code that still uses an example address as its base URL. This guide shows where that address usually lives, how to move it to configuration, and how to prevent it from happening again.

## The response you get

Every request with a body, to an API-style path such as `/v2/pet`, or that asks for JSON, receives `410 Gone` with a problem description (RFC 9457):

```
HTTP/1.1 410 Gone
Content-Type: application/problem+json; charset=utf-8

{"type":"https://example-petstore.com/#where","title":"Example domain, not a real service",
 "status":410,"detail":"api.example-petstore.com is an example domain used in documentation. …"}
```

This domain is not the Swagger Petstore sample API, which lives at [`petstore.swagger.io`](https://example-petstore.com/guides/swagger-petstore).

## Where the address lives

- a constant or default value in the code (`BASE_URL = "https://api.example-petstore.com"`);
- a configuration file, `.env` file or environment variable copied from an example;
- the `host` or `servers` field of an OpenAPI description used to generate a client;
- a Postman or Insomnia environment variable such as `{{baseUrl}}`;
- tests, fixtures and CI jobs that run against a placeholder.

## Configure it properly

Read the address from configuration and fail loudly when it is missing:

```
# Python: read the address from configuration, not from the code
import os
BASE_URL = os.environ["API_BASE_URL"]

// JavaScript / Node.js
const baseURL = process.env.API_BASE_URL;
```

```
# Python, httpx
client = httpx.Client(base_url=os.environ["API_BASE_URL"])

// Node.js, axios
const api = axios.create({ baseURL: process.env.API_BASE_URL });

# Generated OpenAPI client (Python)
configuration = Configuration(host=os.environ["API_BASE_URL"])
```

In Postman or Insomnia, set `baseUrl` per environment and select the right environment before sending.

## Prevent it

Add a start-up or test check that rejects example addresses:

```
import os, re
base = os.environ["API_BASE_URL"]
if re.search(r"example-(petstore|commerce-host)\.com", base):
    raise RuntimeError(f"API_BASE_URL still points at an example domain: {base}")
```

In your own documentation and examples, use names reserved for that purpose, such as `api.example.com`. See [example domains](https://example-petstore.com/example-domains).

## Keys that were sent

If requests carried an API key, token, password or session cookie, they reached the wrong server. Revoke them at the service that issued them and issue new ones. [Leaked credentials: what to do now](https://example-petstore.com/guides/leaked-credentials).

Testing without the real service: [Test against a mock API, not a placeholder](https://example-petstore.com/guides/mock-api)

## Sources

- [RFC 9457: Problem Details for HTTP APIs](https://www.rfc-editor.org/rfc/rfc9457.html) IETF
- [Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) OWASP
- [Swagger Petstore sample API](https://petstore.swagger.io/) Swagger