diff --git a/services/blob/src/config.rs b/services/blob/src/config.rs
--- a/services/blob/src/config.rs
+++ b/services/blob/src/config.rs
@@ -1,11 +1,11 @@
 use anyhow::{ensure, Result};
-use clap::{builder::FalseyValueParser, Parser};
+use clap::Parser;
 use once_cell::sync::Lazy;
 use tracing::info;
 
 use crate::constants::{
-  DEFAULT_GRPC_PORT, DEFAULT_HTTP_PORT, DEFAULT_S3_BUCKET_NAME, LOCALSTACK_URL,
-  S3_BUCKET_ENV_VAR, SANDBOX_ENV_VAR,
+  DEFAULT_GRPC_PORT, DEFAULT_HTTP_PORT, DEFAULT_S3_BUCKET_NAME,
+  S3_BUCKET_ENV_VAR,
 };
 
 #[derive(Parser)]
@@ -17,15 +17,10 @@
   /// HTTP server listening port
   #[arg(long, default_value_t = DEFAULT_HTTP_PORT)]
   pub http_port: u16,
-  /// Run the service in sandbox
-  #[arg(long = "sandbox", default_value_t = false)]
-  // support the env var for compatibility reasons
-  #[arg(env = SANDBOX_ENV_VAR)]
-  #[arg(value_parser = FalseyValueParser::new())]
-  pub is_sandbox: bool,
-  /// AWS Localstack service URL, applicable in sandbox mode
-  #[arg(long, default_value_t = LOCALSTACK_URL.to_string())]
-  pub localstack_url: String,
+  /// AWS Localstack service URL
+  #[arg(env = "LOCALSTACK_ENDPOINT")]
+  #[arg(long)]
+  pub localstack_endpoint: Option<String>,
   #[arg(env = S3_BUCKET_ENV_VAR)]
   #[arg(long, default_value_t = DEFAULT_S3_BUCKET_NAME.to_string())]
   pub s3_bucket_name: String,
@@ -58,12 +53,9 @@
 pub async fn load_aws_config() -> aws_types::SdkConfig {
   let mut config_builder = aws_config::from_env();
 
-  if CONFIG.is_sandbox {
-    info!(
-      "Running in sandbox environment. Localstack URL: {}",
-      &CONFIG.localstack_url
-    );
-    config_builder = config_builder.endpoint_url(&CONFIG.localstack_url);
+  if let Some(endpoint) = &CONFIG.localstack_endpoint {
+    info!("Using Localstack. AWS endpoint URL: {}", endpoint);
+    config_builder = config_builder.endpoint_url(endpoint);
   }
 
   config_builder.load().await
diff --git a/services/blob/src/http/mod.rs b/services/blob/src/http/mod.rs
--- a/services/blob/src/http/mod.rs
+++ b/services/blob/src/http/mod.rs
@@ -13,7 +13,8 @@
 }
 
 fn cors_config() -> Cors {
-  if CONFIG.is_sandbox {
+  // For local development, use relaxed CORS config
+  if CONFIG.localstack_endpoint.is_some() {
     // All origins, methods, request headers and exposed headers allowed.
     // Credentials supported. Max age 1 hour. Does not send wildcard.
     return Cors::permissive();
diff --git a/services/blob/src/s3.rs b/services/blob/src/s3.rs
--- a/services/blob/src/s3.rs
+++ b/services/blob/src/s3.rs
@@ -107,7 +107,7 @@
   pub fn new(aws_config: &aws_types::SdkConfig) -> Self {
     let s3_config = aws_sdk_s3::config::Builder::from(aws_config)
       // localstack doesn't support virtual addressing
-      .force_path_style(crate::config::CONFIG.is_sandbox)
+      .force_path_style(crate::config::CONFIG.localstack_endpoint.is_some())
       .build();
     S3Client {
       client: Arc::new(aws_sdk_s3::Client::from_conf(s3_config)),