# Sandbox keys and test values

> Test mode never calls paid providers, never sends messages and never costs anything.

Source: https://docs.okyc.stream/get-started/sandbox

## API keys

Create keys in the dashboard under **Developers → API keys**. A key is shown once; store it in your secret
manager.

| Prefix      | Mode | What happens                                                                                                                                                                                                             |
| ----------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `sk_test_…` | test | No paid provider is ever called and OTPs are never sent. Checks routed to a registry use the mock provider (magic values below); checks verified [manually](https://docs.okyc.stream/concepts/manual-verification.md) work exactly as in live mode. |
| `sk_live_…` | live | Real providers and real messages; never the mock provider. Only admins can create live keys.                                                                                                                             |

The mode comes from the key alone: a session created with a test key is a test session, and its webhooks go
to test-mode endpoints. Webhook endpoints and their signing secrets are per mode too.

> **Warning:** Secret keys are for servers only. Apps and browsers get the session `url` / `client_token` instead.

## Magic values

Use these in a test session (in the hosted flow) or with direct checks (`POST /v1/checks/:key`). Registry
checks (PAN, bank, GSTIN, MCA, Udyam) use them only when a registry provider is routed for that check; by default
they are [verified manually](https://docs.okyc.stream/concepts/manual-verification.md), in test mode too.

| Input             | Value                    | Result                                                                                            |
| ----------------- | ------------------------ | ------------------------------------------------------------------------------------------------- |
| Phone / email OTP | `123456`                 | Test sessions never send messages; the code is always this value                                  |
| PAN               | `ABCPE1234F`             | `passed` (returns a test name and date of birth)                                                  |
| PAN               | `ABCPE0000F`             | `failed` (invalid PAN)                                                                            |
| PAN               | `ABCPE9999F`             | provider `error` (retried, then the session goes to review)                                       |
| PAN               | `ABCPD1234D`             | `passed`; a [duplicate check](https://docs.okyc.stream/concepts/duplicates.md) matches any earlier test session that used it |
| UPI VPA           | `success@okyc`           | `passed`                                                                                          |
| UPI VPA           | `failure@okyc`           | `failed` (account not found); bank account numbers ending in `0000` also fail                     |
| GSTIN             | `29AABCO1234E1ZT`        | `passed`, status Active                                                                           |
| GSTIN             | `29AABCO0000E1Z7`        | `failed`, status Cancelled                                                                        |
| CIN               | `U72900KA2020PTC123456`  | `passed`, company Active                                                                          |
| CIN               | `U72900KA2020PTC000000`  | `failed`, company Strike Off                                                                      |
| Sanctions name    | `Test Sanctioned Person` | screening hit → the session goes to review                                                        |

Any other value behaves like a plausible `passed` result, so a test integration works end to end.

## Test data in the hosted flow

Test sessions show **Use test data** under each step's heading. It fills in the step with test data and submits
it, so you can walk a whole workflow without real documents or a camera:

* typed values (PAN, bank account, GSTIN, company numbers, address) — the passing values from the table above;
* a sample document wherever a reviewer needs one (PAN card, cancelled cheque, GST certificate…), marked as a
  sandbox document; its fields are read back into the reviewer's side-by-side view;
* Aadhaar: a sandbox-signed Secure QR or Offline XML ZIP, or a sandbox DigiLocker sign-in, verified for real
  against the sandbox UIDAI certificate (the Offline XML share code is `1234`);
* selfie and liveness: sample photos with passing sandbox face results;
* directors and business documents in KYB workflows.

Consent is a click, and the OTP step shows its test code instead. Everything else runs as it does live — only
external services (registries, message delivery, DigiLocker, and the face and document models for test data) are
simulated. A real selfie or document in a test session still runs the real models, so you can test those end to
end too.