---
title: "Try the Sandbox API"
description: "Inspect real same-origin Sandbox licensing requests without storing credentials, using Live keys or requiring a developer account to read."
slug: "/docs/v1/api/try-it"
section: "API reference"
order: 43
audience: "all"
level: "intermediate"
last_updated: "2026-10-17"
version: "v1"
related: ["/docs/v1/start/authentication", "/docs/v1/api/conventions"]
draft: false
---
Use a test [license](/docs/v1/start/glossary#license) to inspect [activation](/docs/v1/start/glossary#activation), validation and deactivation; this console never grants application access.

## What you will learn
- Send real [Sandbox](/docs/v1/start/glossary#sandbox) requests and see the API reply.
- Understand in-memory credentials, [device](/docs/v1/start/glossary#device) seats and the [Live](/docs/v1/start/glossary#live) guard.

## Prerequisites
- Read [API conventions](/docs/v1/api/conventions).
- Complete [the Sandbox quickstart](/docs/v1/start/quickstart).

## Before sending a request
Create a Sandbox [product](/docs/v1/start/glossary#product)/plan/license using the [quickstart](/docs/v1/start/quickstart). Copy its [public App ID](/docs/v1/start/glossary#public-app-id) and TEST-prefixed [license key](/docs/v1/start/glossary#license-key). Reading documentation requires no account; obtaining your own test license requires your Sandbox workspace. Do not use a real buyer email or any Live credential.
The console uses the current site origin and a fixed SANDBOX activation header. There is no user-supplied target URL or Live environment selector. The TEST-prefix input check is helpful UX; the actual API environment-scoped lookup is the trust boundary. [Developer API keys](/docs/v1/start/glossary#developer-api-key) are not accepted here.

## Interactive inspector
The same-origin Sandbox inspector is available on this page in a browser with JavaScript. It sends test activation/validation/deactivation requests, holds the returned token only in memory and never accepts a pasted activation token. The source examples remain readable without JavaScript.

## How to use it
1. Retrieve the public key if you want to inspect the current verification-key response. Expected: JSON with algorithm/key_id/public_key/encoding.
2. Enter your test App ID, Sandbox key and optional matching email. Expected: a temporary random [installation ID](/docs/v1/start/glossary#installation-id) appears only on this page.
3. Confirm that the data is for testing, then activate. Expected: the real API accepts or rejects the request; a successful Sandbox token is held only in this page memory.
4. Validate that same installation. Expected: a fresh signed snapshot or an explicit refusal; no application [feature](/docs/v1/start/glossary#feature) is enabled by this inspector.
5. Deactivate before clearing/reloading if you want to release the seat. Expected: success releases the concurrent seat, but does not reset lifetime activation_count.
6. Clear sensitive data when finished. Expected: form values/token/response are removed from this page; clearing by itself does not deactivate a seat.
Refreshing, navigating away or clearing loses the console token/temporary identity. A new activation can consume another lifetime activation. Recover an abandoned test seat through your supported Sandbox device controls; do not mistake cache clearing for deactivation.

## Privacy and security boundaries
Requests go directly to this site API over HTTPS, never through a documentation proxy or external service. Authorization is sent only for the in-memory token obtained by this console successful Sandbox activation. You cannot paste a Live [activation token](/docs/v1/start/glossary#activation-token). Validation/deactivation remain disabled until that Sandbox activation succeeds.
Credentials are not written to localStorage, sessionStorage, cookies, indexedDB, feedback, analytics or console logs by this inspector. The form and response exist temporarily in browser memory. HTTP requests necessarily transmit your test inputs to the API. The normal API metadata logger records method/path/status/[request ID](/docs/v1/start/glossary#request-id) and hashed IP, not Authorization or request bodies.
The response token is hidden by default; a deliberate reveal checkbox shows it only on this screen. A signed license payload may include your supplied test email and other test [customer](/docs/v1/start/glossary#customer) fields. Avoid screenshots or screen sharing with sensitive details. Your own browser extensions, [developer](/docs/v1/start/glossary#developer) tools and device administrator are outside the page security boundary.
The console deliberately inspects transport and server behavior; it does not implement local Ed25519 access authorization or fix the SDK/idempotency limitations. Use the [verification vectors](/docs/v1/security/test-vectors) when building an application client.

## Expected result
You can see real Sandbox HTTP status/body/request ID while token operations remain bound to a Sandbox activation created in this page.

## Common mistakes
- Using a Live license or trying to paste a developer API key.
- Clearing/reloading before deactivation and assuming the seat was released.
- Treating a displayed JSON success as your application entitlement gate.

## Security notes
Use only test data. No hosted request is automatically sent when opening this page. Unknown/invalid responses do not enable token actions. JavaScript is required only for sending requests, not for reading examples.

## Troubleshooting
| Symptom | Cause | Action |
| --- | --- | --- |
| Validate/deactivate disabled | No successful Sandbox activation in this page memory | Activate a test installation here first |
| Key rejected before request | Not a TEST-prefixed Sandbox key | Use a license from your Sandbox workspace |
| Email mismatch | Nonempty email does not match customer | Use the license customer email or intentionally test key-only mode |
| Request interrupted | Network/timeout/redirect/unexpected response | No access is granted; reconcile any consumed test seat before retrying |

## Next steps
Review [the endpoint reference](/docs/v1/api/public-key) and [signature verification](/docs/v1/security/verify-ed25519).

## Related
- [Authentication](/docs/v1/start/authentication)
- [API conventions](/docs/v1/api/conventions)
- [License lifecycle](/docs/v1/start/license-lifecycle)