Testing in sandbox
Every partner account comes with a built-in sandbox (test mode), an isolated copy of your account with its own API keys, deals, users, analytics, and webhooks. Nothing you do in sandbox affects your live data, so you can build and verify your integration end-to-end before flipping to live.
This mirrors how Stripe separates test mode from live mode.
What’s isolated
| Resource | Live | Sandbox |
|---|---|---|
| API keys | pk_live_… / sk_live_… | pk_test_… / sk_test_… |
| Deals, users, analytics, webhooks | Live data | Separate sandbox data |
| Global marketplace deals | Visible | Also visible (realistic test catalogue) |
Your sandbox is seeded with a couple of sample deals on day one so you have something to list and redeem immediately.
Authenticating against sandbox
Use your test key pair with the same authentication endpoint:
POST /v1/authentications{
"public_key": "pk_test_...",
"private_key": "sk_test_..."
}The returned JWT is scoped to your sandbox, every subsequent request made with it reads and writes sandbox data only. There is no separate base URL or header to set on the API: the key you authenticate with determines the mode.
Find your test keys in the Partner Portal under API Keys, alongside your live keys. The test private key is shown once on creation or regeneration, regenerate it any time (this does not affect your live keys).
Webhooks
Webhook endpoints are registered separately for each mode, by the platform team against your sandbox and live accounts. A sandbox event only triggers your sandbox webhook endpoints; a live event only triggers live ones. This lets your sandbox endpoints point at a local tunnel (e.g. ngrok) while live points at production.
The hosted storefront
If you use the hosted storefront, your sandbox is reachable at your sandbox subdomain:
https://<your-slug>-sbx.<base-domain>It renders the same branded experience as live, against sandbox data, and shows a TEST badge so it’s never mistaken for production.
The embed widget (coming soon)
The embeddable iframe widget is not generally available yet. When it ships, it will be scoped by the subdomain it loads from rather than by an API key, so you will point the iframe at your sandbox subdomain (https://<your-slug>-sbx.<base-domain>/embed) to render it against sandbox data, useful for previewing the widget on a staging site before going live.
Going live
When your integration works in sandbox, switch your server to your sk_live_ key. No other code changes are required, the request shapes are identical across modes.