tk_test_...) calls the same endpoints with the same request and response shapes as a live key, so the code you write against it is the code you ship.
Get a test key
Open your application, then Application settings → API keys, choose Create a key, and set Type to Test. The key is shown in full once. Who manages the application’s keys (the owner, or an admin or developer whose access covers the whole application) can create one. A test key works while the application is in review or approved. It stops working while the application is rejected or suspended (403 account_not_active).
What is different
- One destination only. Messages go only to the phone the account owner verified at signup. No other number can be added. Any other destination answers
422 sandbox_unverified_destination. - A visible stamp. Every message carries an unremovable
[TEST]/[تجريبي]stamp, before any other line. - A neutral name for a flagged one. If screening flagged the application’s name, test messages carry “Test App” / «تطبيق تجريبي» in its place.
- A lifetime cap. 10 sends per application, charged from the same prepaid balance as live sends, so testing cannot consume the whole welcome credit. Each verification counts once, its resends included, and a send that never left does not count. The cap answers
429 sandbox_quota_exceeded. - No protection guard. The spend cap, the per-IP cap and the pumping pause apply to live keys only. The hourly cap per number still applies.
- SMS only. WhatsApp cannot be used in the sandbox at all. The Verify API refuses it with
422 sandbox_unsupported_channel, and the WhatsApp endpoints with403 live_key_required. - E-mail in test mode. A test key with Email set to send sends e-mail to the simulator addresses only, with the whole flow of statuses and webhooks, and nothing is sent or charged. See Test mode.
- Custom access covers Verify and Email. A test key can be narrowed like a live key, to check only or to send and check, but it cannot be granted Notifications: a custom test key answers
403 insufficient_scopeon the WhatsApp endpoints. See Key access.
There are no magic numbers and no fixed test codes. Every test send is a real SMS to the owner’s phone with a real code, so the sandbox tests exactly what production will do.
Try it in the console
Verify → Test (“Try Verify in a minute”) sends a test code to the account owner’s phone, lets you type it in, and shows each API response. It then gives you the two requests to copy to your server. If the application has no test key yet, the page creates one and shows it in full that one time. These sends go through the API as the application’s test key: they are charged like any code and count toward the 10 test sends.A typical test
1
Find your test number
It is the account owner’s verified phone, the only number a test key can reach. Verify → Test shows it.
2
Run the two calls
Follow the Verify quickstart with the test key. Read the code off the phone and check it.
3
4
Check your webhook
If you set a webhook under Application settings → Webhooks, the test verifications reach it too, with
"mode": "test" in data. See Webhooks.Partners
A partner’s sandbox key (tk_partner_test_...) works across every client application, with daily caps instead of the lifetime one, and changes nothing through the management endpoints. The sandbox key has its rules.