Switching IAP between sandbox and production

Hi, since we have a single postUrl, how can my server differentiate between a test IAP transaction and a real one? The only way I can think of right now is by setting a flag to the test user on my database, but what if during the app review, Apple tests with a user that I don't know about?

Ideally the app would use a different postUrlwhen processing a test transaction.

Can you please advise?