Sandbox

Free, unlimited, no account. Key sk_test_demo.

Deterministic outcomes

The sandbox steers off the amount, so a test suite can assert without waiting on chance:

…01	`Y` — authenticated
…02	`N` — not authenticated
…03	`U` — unavailable
…04	`A` — attempted
…05	expiry after 30 s
…06	session expires after three failed attempts

Any other amount is decided deterministically from the authenticationId, so the result is stable per session and varied across a run.

Force a mode

Add sandbox.forceMode to the request body: sms, email, push, app_code, qr, biometric, question, oob, otp_passthrough.

Force frictionless

sandbox.forceFrictionless: true skips the challenge and finishes with Y. Useful to test the no-challenge branch without waiting for a lucky issuer.

Notifications in the sandbox

Delivery is immediate, and every retry is executed on a compressed clock — seconds instead of hours. localhost over HTTPS is accepted; plain HTTP is not.

What the sandbox does not simulate

Real issuer behaviour. BINs are mapped, the issuer never answers.
Scheme connectivity. A sandbox Y proves your code path, not scheme certification.
Production rate limits — these are relaxed by a factor of ten.

Never ship the test key. A test key in production returns auth_invalid the moment a real card hits it, and the failure looks like an outage.

Next: API reference