Sandbox keys and test values
Test mode never calls paid providers, never sends messages and never costs anything.
API keys
Create keys in the dashboard under Developers → API keys. A key is shown once; store it in your secret manager.
| Prefix | Mode | What happens |
|---|---|---|
sk_test_… | test | No paid provider is ever called and OTPs are never sent. Checks routed to a registry use the mock provider (magic values below); checks verified manually work exactly as in live mode. |
sk_live_… | live | Real providers and real messages; never the mock provider. Only admins can create live keys. |
The mode comes from the key alone: a session created with a test key is a test session, and its webhooks go to test-mode endpoints. Webhook endpoints and their signing secrets are per mode too.
Secret keys are for servers only. Apps and browsers get the session url / client_token instead.
Magic values
Use these in a test session (in the hosted flow) or with direct checks (POST /v1/checks/:key). Registry
checks (PAN, bank, GSTIN, MCA, Udyam) use them only when a registry provider is routed for that check; by default
they are verified manually, in test mode too.
| Input | Value | Result |
|---|---|---|
| Phone / email OTP | 123456 | Test sessions never send messages; the code is always this value |
| PAN | ABCPE1234F | passed (returns a test name and date of birth) |
| PAN | ABCPE0000F | failed (invalid PAN) |
| PAN | ABCPE9999F | provider error (retried, then the session goes to review) |
| PAN | ABCPD1234D | passed; a duplicate check matches any earlier test session that used it |
| UPI VPA | success@okyc | passed |
| UPI VPA | failure@okyc | failed (account not found); bank account numbers ending in 0000 also fail |
| GSTIN | 29AABCO1234E1ZT | passed, status Active |
| GSTIN | 29AABCO0000E1Z7 | failed, status Cancelled |
| CIN | U72900KA2020PTC123456 | passed, company Active |
| CIN | U72900KA2020PTC000000 | failed, company Strike Off |
| Sanctions name | Test Sanctioned Person | screening hit → the session goes to review |
Any other value behaves like a plausible passed result, so a test integration works end to end.
Test data in the hosted flow
Test sessions show Use test data under each step's heading. It fills in the step with test data and submits it, so you can walk a whole workflow without real documents or a camera:
- typed values (PAN, bank account, GSTIN, company numbers, address) — the passing values from the table above;
- a sample document wherever a reviewer needs one (PAN card, cancelled cheque, GST certificate…), marked as a sandbox document; its fields are read back into the reviewer's side-by-side view;
- Aadhaar: a sandbox-signed Secure QR or Offline XML ZIP, or a sandbox DigiLocker sign-in, verified for real
against the sandbox UIDAI certificate (the Offline XML share code is
1234); - selfie and liveness: sample photos with passing sandbox face results;
- directors and business documents in KYB workflows.
Consent is a click, and the OTP step shows its test code instead. Everything else runs as it does live — only external services (registries, message delivery, DigiLocker, and the face and document models for test data) are simulated. A real selfie or document in a test session still runs the real models, so you can test those end to end too.
How it works
One session per applicant — created by your backend, completed in the hosted flow, decided by rules or a reviewer.
10-minute quick start
Create a test session, complete it with sandbox values and receive the webhook.
© 2026 Aiistic Technologies Private Limited. OKYC is a product of Aiistic Technologies Private Limited. Privacy notice