Sandbox & test keys

The sandbox lets an engineer try the entire Sender API before any contract or know-your-business check. You verify an email, sign in to the portal, mint a kpk_test_ key, and call the same endpoints you would in production, only against a separate, synthetic data plane where nothing is billed and no real person is ever contacted.

Get a test key

Signup is fully self-serve. First, submit your email:

curl -X POST https://api.keepable.co/sandbox/signup \
  -H "Content-Type: application/json" \
  -d '{ "email": "you@example.com" }'

{ "message": "If that email can start a sandbox, a verification link is on its way." }

The response is identical whether or not the address is already in use, so it never reveals who has signed up. Open the verification link we email you and POST its token back:

curl -X POST https://api.keepable.co/sandbox/verify \
  -H "Content-Type: application/json" \
  -d '{ "token": "sbx_9f8e7d..." }'

{
  "tenant_id": "ten_01HXP",
  "session_token": "sess_...",
  "session_expires_at": "2026-05-24T09:30:00Z",
  "email": "you@example.com",
  "mode": "sandbox"
}

Verify returns a sandbox session token, not an API key. It signs you in to the portal (the portal stores it in a sender_session cookie), where you set up a passkey and mint kpk_test_ API keys from the dashboard. Send a minted key as Authorization: Bearer on every call; see Authentication for scoping, rotation, and revocation.

What's different in the sandbox

The sandbox runs the same code as production, with every costly or irreversible side-effect mocked:

You do not need an approved tenant, an accepted agreement, or a funded wallet to use the sandbox. Those are only required to go live.

Magic test data

Verification outcomes are driven by the last digit of the document number you submit (a NIN for a person, a CAC/RC or TIN for a business), so you can exercise every branch on demand without a real identity:

An empty document number also approves, so a happy-path test that omits it still succeeds. For example, a NIN of 12345678901 approves; 12345678900 is rejected; 12345678909 returns provider-unavailable.

Next steps

• Send your first content with your test key.
• When you're ready for production, follow Going live.