Sandbox
A free environment that behaves like production
Build and test the whole integration before any money or real user is involved.
Separate by construction, not by convention
Sandbox and production credentials are distinct records with a hard environment discriminator. A sandbox key cannot authenticate a production request and cannot read production data. That separation is enforced in the data layer, not left to a naming convention.
The same flows, not a simulation
Passkey registration, passkey sign-in, login intents, action intents and webhooks all run the real code paths. What differs is the data they touch, not the logic they exercise.
Clearly marked everywhere
Anything in sandbox is labelled TEST MODE in the interface, in the API responses and in the webhooks, so a test event can never be mistaken for a real one in a log or a support ticket.
Included allowance
The sandbox includes one application, one sandbox domain, a small team, and a monthly volume of test authentications sufficient for building and running an integration test suite. Exact limits are configurable and shown in your developer area.
Sandbox usage never becomes an invoice
Sandbox events are metered separately from production and are excluded from billing. They are also excluded from the public network counters, so testing never inflates figures anyone else sees.
Create a sandbox application
No card, no sales call, no expiry on the free tier.