Sandbox

Everything you need to build the whole integration — before you have an account, a contract, or a conversation with us.

The keys

These are published on purpose. They authenticate to a tenant whose entire contents are seeded and documented, and they are rotated if that ever stops being true.

Key	Value	Use it for
Publishable	`pk_test_foldkit_public_sandbox_publishable_key_0001`	Mounting the editor in a page, from any origin.
Secret	`sk_test_foldkit_public_sandbox_secret_key_0001`	Everything on `/v1`: designs, exports, assets, webhooks, usage.
Tenant slug	`sandbox`	The raw-iframe `?t=` parameter.

How the sandbox differs from a real tenant

Three differences, and each one exists so you can work without us. Every other behaviour — the API shapes, the webhook signatures, the error codes, the quotas — is identical, which is the point.

Behaviour	Sandbox	Your tenant
Publishable key origins	Any origin at all	Only origins you have verified
Framing the editor	Any page may frame it	Only your verified origins, enforced by `frame-ancestors`
Exports	Complete instantly with a placeholder file	Rendered for real, in seconds to minutes

The placeholder export is a real, valid file of the right type — a PDF opens, an SVG renders, a DXF parses — carrying a line of text saying what it is. Your download handling, your signed-URL fetch and your hand-off to fulfilment are all exercised properly; only the geometry is fake.

Everything else about an export is real, including the export.completed webhook. That is deliberate: verifying a signature against a delivery we actually sent is most of what the sandbox is for.

The webhook echo

Webhooks have one prerequisite that has nothing to do with us: a public HTTPS endpoint. Until you have one you cannot see a delivery at all, which means the first hour of the integration goes on tunnels and TLS rather than on our payload.

Point your endpoint at the echo instead, then read the delivery back. Pick any label; it is not a credential, so use one nobody else would.

curl -X POST https://foldkit.theboxes.asia/api/v1/webhooks \
  -H "Authorization: Bearer sk_test_foldkit_public_sandbox_secret_key_0001" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://foldkit.theboxes.asia/api/sandbox/echo/my-label-9f2c",
    "events": ["design.saved", "export.completed"]
  }'

Read what arrived

curl https://foldkit.theboxes.asia/api/sandbox/echo/my-label-9f2c

Each delivery comes back with the headers we sent — including foldkit-signature — and the body exactly as bytes, not re-serialised. That matters: signature verification is over bytes, and a payload that had been through JSON.parse and back would fail to verify no matter how correct your verifier was.

A bucket keeps its last 25 deliveries.
Anything older than an hour is dropped.
DELETE the same URL to empty a bucket.

Then check your verifier against it — see the webhook guide, which has working code in Node, PHP and Python.

What is in there

Four ready-made designs, so GET /v1/designs is never an empty array on your first call.
The full template gallery, across every box style we ship.
Whatever you and everybody else create. It is shared and it is disposable — do not put anything in it you would mind a stranger reading.

When you are ready

Swap the key, declare your origins, and everything else in your integration stays as it is. See step 4 of the quickstart.

← Quickstart

Concepts →