Skip to main content
A sandbox key (tk_test_...) is issued the moment onboarding completes. It calls the exact same endpoints with the exact same request and response shapes as a live key, so the code you write against it is the code you ship.

​
What is different

  • Proven destinations only. Messages go only to numbers the account has proven it owns, up to 3 per account. Add one in the dashboard with an OTP round-trip. Any other destination answers 422 sandbox_unverified_destination.
  • A visible stamp. Every message carries an unremovable [TEST] / [تجريبي] stamp, before any other line.
  • A lifetime cap. 10 sends per application, charged from the same prepaid balance as live sends, so testing cannot consume the whole welcome credit. The cap answers 429 sandbox_quota_exceeded.
  • SMS only. WhatsApp cannot be used in the sandbox at all. The Verify API refuses it with 422 sandbox_unsupported_channel, and the WhatsApp endpoints with 403 live_key_required.

​
A typical test

1

Prove a number

In the dashboard, add your own mobile as a sandbox destination and type the code it receives.
2

Run the two calls

Follow the Quickstart with the sandbox key. Read the code off your phone and check it.
3

Exercise the failure paths

Type a wrong code to see invalid_code and attempts_remaining count down. Call resend and cancel. Wait out the lifetime to see expired.
Unit tests should not hit the sandbox: every send is a real SMS and counts against the cap. Record the documented responses as fixtures instead; the API reference carries every example body.