Sandbox Testing

OpenSylo provides a sandbox environment for testing the full integration without affecting production data.

Sandbox Endpoints

Endpoint	Description
`GET /sandbox/info`	Sandbox environment info, limitations, rate limits
`GET /sandbox/test-credentials`	OAuth test credentials for sandbox marketplaces
`GET /sandbox/test-merchants`	Test merchant accounts by credit tier

No authentication is required for sandbox info endpoints.

How Sandbox Works

Sandbox credentials are automatically generated when an admin invites a marketplace with sandbox mode enabled. Sandbox client IDs are prefixed with sb_ (e.g., sb_yourplatform_client_a1b2c3d4).

Opensylo automatically detects sandbox requests by the sb_ prefix on the client ID — no code changes are needed on your side. All API endpoints work the same way in sandbox and production.

Sandbox Environment Info

Response:

{
  "enabled": true,
  "environment": "sandbox",
  "version": "1.0",
  "limitations": [
    "Sandbox data is reset daily at 2:00 AM UTC",
    "Sandbox tokens expire after 7 days",
    "No real financial transactions are processed",
    "Credit scores are simulated based on test merchant tier",
    "All sandbox credentials use plaintext secrets (documented publicly)",
    "Sandbox requests are isolated from production data"
  ],
  "documentationUrl": "https://api.opensylo.com/api-docs",
  "rateLimits": {
    "requestsPerMinute": 120,
    "requestsPerHour": 3600
  },
  "tokenExpiryDays": 7
}

Test Merchant Tiers

The sandbox includes 5 pre-seeded merchant accounts representing different credit profiles:

Tier	Email	Password	Credit Score	Risk Level	Lending Cap (NGN)	Description
A	`tier-a@sandbox.opensylo.com`	`SandboxTierA123!`	85	Low	10,000,000	Premium approval flow
B	`tier-b@sandbox.opensylo.com`	`SandboxTierB123!`	72	Low	5,000,000	Standard approval flow
C	`tier-c@sandbox.opensylo.com`	`SandboxTierC123!`	55	Medium	2,000,000	Conditional approval
D	`tier-d@sandbox.opensylo.com`	`SandboxTierD123!`	40	High	500,000	Pilot/small ticket
E	`tier-e@sandbox.opensylo.com`	`SandboxTierE123!`	25	Very High	0	Rejection flow

Use different tiers to test various scenarios:

Tier A/B — Test the full happy path: data submission, credit scoring, loan approval, disbursement, repayment, and completion.

Tier C — Test conditional approval flows where additional requirements may apply.

Tier D — Test small-ticket/pilot lending scenarios.

Tier E — Test the rejection flow and how your integration handles denied applications.

Sandbox Credentials

Default redirect URIs for sandbox:

http://localhost:3000/oauth/callback
http://localhost:8080/callback
https://*/oauth/callback

These redirect URIs are pre-configured, so you can test locally without registering specific URLs.

Daily Reset

The sandbox environment is automatically reset daily at 2:00 AM UTC:

All OAuth access tokens and authorization codes are cleared

Test merchant data is re-seeded to default values

Marketplace credentials are preserved (not affected by reset)

Plan your testing accordingly — long-running test scenarios should be completed within a single day, or you should design your test flow to re-authenticate after a reset.

Sandbox vs. Production Differences

Aspect	Sandbox	Production
Client ID prefix	`sb_`	No prefix
Token expiry	7 days	Access: 1 hour, Refresh: 30 days
Credit scores	Simulated (fixed per tier)	Calculated from submitted data
Financial transactions	None processed	Real transactions
Data reset	Daily at 02:00 UTC	Never
Secrets	Plaintext (for convenience)	Hashed
Rate limits	Documented but not enforced	Enforced
Data isolation	Fully isolated from production	Production data

Testing Checklist

Use this checklist to verify your integration before going live:

OAuth Flow — Successfully complete the authorization code + PKCE flow with a sandbox merchant

Token Refresh — Refresh an expired access token using the refresh token

Data Submission — Submit merchant data for a single merchant and receive a credit score

Bulk Submission — Submit data for multiple merchants in a single batch

Credit Score — Retrieve a credit score for a previously submitted merchant

Active Loans — Query active loans for a merchant

Loan Status — Check the status of a specific loan

Deduction Validation — Validate deduction amounts for a sale

Inbound Webhooks — Send a repayment webhook with correct HMAC-SHA256 signature

Signature Verification — Verify that incorrect signatures are rejected

Error Handling — Test with invalid tokens, missing fields, and expired codes

Token Revocation — Revoke a token and verify it can no longer be used

Sandbox Endpoints#

How Sandbox Works#

Sandbox Environment Info#

Test Merchant Tiers#

Sandbox Credentials#

Daily Reset#

Sandbox vs. Production Differences#

Testing Checklist#