I believe you can use just one remote access record if you use the 'state' parameter when initializing the OAuth flow. Set state to some value of your choice (ie: 'production' or 'sandbox') when you construct the initial url.
Redirect(authURL
+ "?response_type=code&client_id="
+ clientid
+ "&state="
+ (authURL.contains("test.salesforce.com") ? "sandbox" : "production")
+ "&redirect_uri="
+ WS.encode(play.mvc.Router
.getFullUrl("ForceDotComOAuth2.callback")));
When OAuth callback is called, you can check the state param (it is passed back with the code param) - determine if the state is production or sandbox, and then send your post response to the prod or sandbox token url depending on value retrieved from the state param.
String sandboxParam = Params.current().get("state");
boolean sandboxLogin = false;
if (sandboxParam != null) { // defensive null check, should always have value
sandboxLogin = sandboxParam.contains("sandbox");
}
Map params = new HashMap();
params.put("grant_type", "authorization_code");
params.put("client_id", clientid);
params.put("client_secret", secret);
params.put("redirect_uri",
play.mvc.Router.getFullUrl("ForceDotComOAuth2.callback"));
params.put("code", accessCode);
HttpResponse response = WS.url(sandboxLogin ? TOKEN_URL_sBox : TOKEN_URL).params(params).post();