# Sandbox and test mode

> Test keys reach a separate test workspace where nothing real is sent or charged.

Source: https://www.ordstage.com/docs/sandbox/

Every business has a **test workspace** (the sandbox) next to its real one. Build and test your integration there
with **test keys**, then switch to a live key when you go live.

| | Live keys `ord_live_…` | Test keys `ord_test_…` |
|---|---|---|
| Data | The business's real data | The test workspace's own data, filled with sample calendars, contacts, products, orders and leads |
| Messages (WhatsApp, Instagram, Messenger, email, SMS) | Sent | Never sent; recorded as simulated deliveries |
| Payments, Stripe, Shopify | Real | Never called |
| AI | The business's assistant and credits | The cheapest model, with 500 test credits a month (refilled on reset); never the business's credits |
| Webhooks | To live subscriptions, signed with their secrets | To test subscriptions, signed with test secrets |

A test key can never reach live data, and a live key can never reach the test workspace. The same request with
the same body behaves the same way in both, so code that works with a test key works with a live key.

## Getting a test key

In **Settings → Developers**, switch to **Test** and create a key. Test keys have the same options as live keys
(scopes, expiry, IP allowlist). The test workspace is created the first time a test key is made.

## Resetting the sandbox

**Settings → Developers → Test → Reset sandbox** wipes the test workspace and fills it with fresh sample data.
Your test keys, test webhooks and request log are kept. Sample objects get new ids after a reset, so look them up
again (for example with List calendars) instead of hard-coding them.

## Try it in the docs

The [API reference](https://www.ordstage.com/docs/reference/) can send real requests from your browser ("Try it"). Use a **test key** there:
the request goes straight from your browser to the API, and the key is kept only in that browser tab.

## When test keys are refused

Test keys need API access, which comes with paid plans. For a business without it, test keys are refused with
`403 sandbox_not_available`; upgrade the plan to use the API and its sandbox.