Skip to content

Sandbox Keys

A sandbox key lets you build and test an integration against the real SIPSTACK API without sending a message, placing a call, or buying a number. Sandbox keys start with sk_test_. Live keys start with sk_live_.

In Switchboard, open Account → Integrations → API keys, create a key, and turn on Sandbox key. Sandbox keys show a Test badge in the key list. You use them exactly like a live key, in the x-api-key header.

RequestWhat happens
Reads (GET)Pass through to the real endpoint and return your organization’s real data, read-only.
Send an SMS/MMS (POST /api/v2/messages/send, POST /api/v2/flare/messages)Simulated. Returns a response shaped like the live one with "sandbox": true. Nothing is sent or billed.
Send a campaign (POST /api/v2/flare/campaigns/{id}/send)Simulated. No one is messaged.
Place a Nova call (POST /api/v2/nova/calls)Simulated. No call is placed.
Trigger an Aura AI call (POST /api/v2/aura/calls)Simulated. No call is placed.
Order a number (POST /api/v2/numbers/order)Simulated. No number is bought.
Any other write (contacts, lists, webhooks, knowledge base, and so on)Refused with 403 and the code SANDBOX_NOT_SUPPORTED. Nothing changes.

Simulated responses carry "sandbox": true, and their IDs are prefixed (for example sbx_call…), so they can’t be confused with live ones. Simulated sends and orders aren’t stored, so they won’t appear when you read your messages or numbers back.

Any write SIPSTACK adds to the API later is refused for sandbox keys until it’s deliberately added to the sandbox. A sandbox key can never change live data.

Use these destination numbers to exercise failure paths. Any other valid number succeeds.

NumberResult
+15005550001400 — invalid destination
+15005550002422 — recipient opted out (SMS) or destination unreachable (calls)
+15005550003SMS accepted (200) with the message status failed

Swap the sk_test_ key for an sk_live_ key. Response shapes are the same, minus "sandbox": true, so code that works against the sandbox works against live. Live sends, calls and orders are real and billed. See Idempotency before you put retries into production.