Sandbox & Testing

Every account can have two kinds of keys: live and sandbox. Build and test with sandbox keys. When everything works, swap in your live keys — nothing else in your code changes.

	Sandbox key	Live key
Starts with	`sbx_`	Anything else
URLs and response shape	Same as live	—
Scoring	None. The answer is chosen by the email (below).	Real
Billing and reports	Never counted	Counted
Request log	Every request, with a fix for any problem, for 14 days	—
Rate limit	60 requests a minute per account	Your plan's limit
Token	Can be shown again on your Sandbox page	Shown once

Use made-up people in the sandbox. Sandbox requests are stored for 14 days so you and we can look at them.

Choose the answer you get

The +tag in the email picks the result. Any other email scores low.

Email	Answer
`test+high@example.com`	High risk, `block: true`. Check that your code stops the sign-up.
`test+medium@example.com`	Medium risk. Check your review path.
`test+low@example.com`	Low risk.
`test+pending@example.com`	`status: pending`. `GET /api/v1/risk_assessments/:id` returns `completed` after 5 seconds.
`test+error@example.com`	A `500`. Check your sign-up still goes through when we cannot answer.
`test+slow@example.com`	Answers after 3 seconds. Check your request timeout.

The risk level and block follow your own account thresholds, so they match what live would say.

curl -X POST "https://revylta.com/api/v1/score" \
  -H "X-API-KEY: sbx_YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "test+high@example.com", "identifier": "test_user_1", "ip": "203.0.113.10", "user_agent": "Mozilla/5.0 ...", "source": "test"}'

The `sandbox` block

Every sandbox answer — good or bad — has one extra field, sandbox. It lists what we noticed about your request and how to fix it, plus a link to the request on your Sandbox page. Live answers never have it.

{
  "environment": "sandbox",
  "sandbox": {
    "hints": [
      {
        "code": "ip_private",
        "severity": "warning",
        "field": "ip",
        "message": "ip 10.0.0.12 is a private or local address. It is your network, not the visitor.",
        "fix": "Send the visitor's public IP. Behind a proxy or load balancer it is usually the first address in X-Forwarded-For."
      }
    ],
    "request_log_url": "https://revylta.com/account/sandbox/requests/123"
  }
}

severity is error (the request failed), warning (it worked, but the data is wrong or weak) or info.

Checking a test

Every sandbox request has its own page with its own check: the key works, the body is JSON, you sent email, IP and user agent, the IP and user agent are the visitor's (not your server's), and the field names are right. It checks that one request only, so after you change your code, send again and open the new request.

The main Sandbox page lists what you have tried across all requests: a blocked sign-up (+high), a review case, a pending answer, an outage (+error), the browser script and an outcome. When your latest request is ready and you have tried these, switch to your live keys. The checks show what you sent — they cannot see what your code did with our answer.

Sandbox & Testing

Choose the answer you get

The sandbox block

Checking a test

The `sandbox` block