With #21, we do not know anymore if we are currently in sandbox or production mode. We seperate the two hosts, so we can later instantiate different Api endpoint objects with different hosts. This enables us to call two different hosts in the same PHP process. In the current scope, just seperating the hosts (and not secrets/keys) should be sufficient.
In order to do so, it was also necessary to store the merchant id during onboarding. includes a bugfix where the cache invalidation did not work because the cache object was constructed with the wrong prefix key.