Sandbox
One API call provisions an isolated sandbox tenant, mints an API key, and seeds a demo signer — no early-access queue, no manual setup.
What ships when you claim a sandbox
The sandbox flow is a mode on the standard self-serve registration endpoint. Everything you get is a real tenant on the real platform — just marked `isSandbox: true` and pre-seeded so your first `curl` succeeds.
Isolated tenant
A new tenant with your chosen name, marked `isSandbox: true`. Sandbox API keys never work against another tenant, and no other tenant's keys work against yours.
API key returned once
The registration response includes the full `esk_test_…` key. It is shown once — store it in your server secret manager, or mint another from Admin → Developer → API Keys.
Seeded demo signer
One customer record (`sandbox-signer-{yourTenantId}`) is pre-created. When seeding succeeds, `sampleTemplateId` is included so the first server call can be create-from-template.
Free plan, no billing setup
Sandbox tenants are locked to the free plan server-side. Registration never touches the billing pipeline, and a `planId` in the request body is ignored when `mode: sandbox` is set.
Webhooks + developer console
Register endpoints in Admin → Developer → Webhooks while signed in. Replay failed deliveries and inspect API requests in Admin → Developer → Console.
Advisory 30-day expiration
The tenant carries an `expiresAt` hint (currently informational — enforcement is a follow-up). Nothing is auto-deleted today; the field is there for the future cleanup job.
Claim a sandbox in one request
Prerequisites: a valid email address and an 8+ character password. Expected output: HTTP 201 with your `tenantId`, `sandbox.apiKey` (shown once), and the seeded `demoCustomerId`.
curl -sS -X POST https://api.endorsedsign.com/api/auth/register \
-H 'Content-Type: application/json' \
-d '{
"tenantName": "Acme Dev Sandbox",
"adminEmail": "you@acme.example",
"password": "your-strong-password",
"mode": "sandbox"
}' | jq '.data | { tenantId, sandbox }'
# {
# "tenantId": "acme-dev-sandbox",
# "sandbox": {
# "apiKey": "esk_test_…", # capture this now — shown once
# "keyPrefix": "esk_test_…",
# "keyId": "…",
# "scopes": ["documents:write", …],
# "demoCustomerId": "sandbox-signer-acme-dev-sandbox",
# "demoCustomerName": "Sandbox Signer",
# "expiresAt": "2026-…"
# }
# }Verify your admin email from your inbox before signing into Admin. The API key works immediately — verification only gates the human console.
From sandbox to production
- 1
Claim your sandbox
POST /api/auth/register with `mode: sandbox`. Capture the returned API key in your secret store.
- 2
Call the API with the sandbox key
Confirm GET /api/v1/zapier/auth/test, then create-from-template and send-for-signing. Register webhooks in Admin → Developer → Webhooks and watch deliveries in the console.
- 3
Review the integration checklist
Confirm webhook signature verification, correlation-id logging, and idempotency. Full checklist in the developer console under Admin → Developer.
- 4
Sign up for production
When you are ready, register a separate production tenant through the same endpoint with `mode: production` (or the standard sign-up UI). Your sandbox tenant stays put so you can keep testing.
Common questions
Claim your sandbox in one call
The endpoint is live today. The response body includes an `esk_test_` key you can confirm from your server.