How do you prevent outbound messages from sandbox orgs as a 3rd party developer?

The outbound message includes the OrganizationId as a parameter. Before I discovered that, I built a formula field on the object using the $organization global variable to pass the org ID, which works as well.

Then you can configure your integration to determine which org it's coming from and process appropriately.

I sent a simple outbound message that just includes the record ID to requestb.in, and it looks as follows. You can see that OrganizationId is included by default.

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <soapenv:Body>
  <notifications xmlns="http://soap.sforce.com/2005/09/outbound">
   <OrganizationId>00DL000000487RxMAI</OrganizationId>
   <ActionId>04kL0000000Cbr1IAC</ActionId>
   <SessionId xsi:nil="true"/>
   <EnterpriseUrl>https://cs8.salesforce.com/services/Soap/c/36.0/00DL000000487Rx</EnterpriseUrl>
   <PartnerUrl>https://cs8.salesforce.com/services/Soap/u/36.0/00DL000000487Rx</PartnerUrl>
   <Notification>
    <Id>04lL000000A8lgyIAB</Id>
    <sObject xsi:type="sf:Error_Log__c" xmlns:sf="urn:sobject.enterprise.soap.sforce.com">
     <sf:Id>a8zL00000004pgFIAQ</sf:Id>
    </sObject>
   </Notification>
  </notifications>
 </soapenv:Body>
</soapenv:Envelope>

However, the only way to prevent the message from being sent would be to include $organization ID in the workflow rule criteria.

I recall from some previous testing that Salesforce might automatically update the rule criteria when it moves to sandbox. I know it sounds bizarre, but i do remember something along those lines happening, will do some more testing and update my answer when I have the details.

UPDATE: Hard-coding $Organization.Id in the workflow rule and deploying between environments worked properly. I cannot recall the exact issue I ran into previously alluded to above, but if you only want the rule to fire only in production, hard-coding $organization.Id into the rule itself will work using the 15 character Id (the 18 character version will not trigger the rule).

UPDATE 2 re-re-reading the thread, i see that you are looking for ways to be control this w out any admin access.

The answer to the following thread looks like it would be helpful. There is a field called IsSandbox on Organization that you can hit to determine if it's coming from prod or sandbox. However, from my testing it doesn't look like you can hit it in workflow criteria, only via apex, so you would need to consider if this might work or not.

Can we determine if the Salesforce instance is production org or a Sandbox org?