Skip to content
Staging sandbox, mock dataEvery value on the staging sandbox is mock data. Never send real customer data or production credentials.

The staging sandbox

Approved partners build against staging hosts that hold mock data only. Keys issued here work on staging and nowhere else.

What the sandbox is

The sandbox is each service's staging environment, reached with a sandbox key you issue yourself once your application is approved. There is no separate "try it" proxy in this portal: call the staging hosts directly from your own code, or use the interactive panels on each service's own reference site.

  • Mock data only. Personas, events, wallets and messages on staging are seeded test data. Never send real customer data to a sandbox key, and never use a production credential against staging.
  • Least privilege. A key carries only the scopes a certification officer approved for your application, and never an administrative scope.
  • Shown once. The plaintext key is shown a single time in a copy-only dialog. If you lose it, rotate: a new key is minted and the old one is revoked.

Isolation per service

Customer 360

Keys carry ingest and read:own. A read:own key reads only the events that key's own source produced; reading another source is refused. Global read access is never issued to partners.

Notification Hub

Sandbox keys are bound to a sandbox brand and never deliver. A send made with a sandbox key is recorded with a sandboxed status and no provider is called. Use @example.com recipients in every example.

Banking partner API

Keys carry embed:read, and embed:payments where the staging settlement configuration allows it. Payment intents stay pending until a staging persona authorises them. Credit and insurance are simulated on staging: responses are marked as simulated and nothing is referred or underwritten.

ZB ID

Partner integrations use client-credential tokens scoped to the certified client. Discovery and signing keys are public.

Rate limits and errors

Unauthenticated or wrongly keyed calls are throttled per address before they are refused, so a misconfigured client sees 429 with Retry-After rather than an unbounded stream of 401. Back off on 429, and do not retry a 401 in a loop: fix the key, or rotate it.

Moving on from the sandbox

When your integration is ready, submit evidence against each check in the certification programme. Production access is not a portal state: after certification it is arranged by operations, and production keys are never issued through this portal.