Get a Sandbox API key

This page issues credentials for the Sandbox only (https://web-api.dev.soxai.site). A Sandbox key never authenticates against Production. To use Production, request access.

The Sandbox identity is passwordless. Choose the role it should hold, and a link is emailed to you. The link is valid for 60 minutes.

Open the link in the email

The link issues your API key and displays it once. Copy it before closing that page - the key is stored as a hash, so nothing, including this site, can show it to you again. Lose it and you register again for a new one.

Look up your uid and org_id

Data endpoints take a UID in the path, and org-scoped endpoints take an org_id. Both come from GET /api/myOrg, which reads them from the key itself and takes no parameter. Call it first:

curl 'https://web-api.dev.soxai.site/api/myOrg' \
  -H 'soxai-api-key: YOUR_SANDBOX_KEY'

{
  "isOrgUser": true,
  "uid": "user123",
  "email": "you@example.com",
  "myOrg": {
    "orgId": "org_ab12cd34",
    "orgName": "SOXAI Research"
  }
}

uid is your own UID and myOrg.orgId is the org_id every org-scoped endpoint takes.

Call the Sandbox with the key

Send the key in the soxai-api-key request header, and use the UID from the previous step in the path:

curl -G 'https://web-api.dev.soxai.site/api/v2/DailyInfoData/user123' \
  --data-urlencode 'start_day=2026-01-01' \
  --data-urlencode 'end_day=2026-01-31' \
  -H 'soxai-api-key: YOUR_SANDBOX_KEY'

Replacing a key

Register the same address again. There is no separate revoke step and nothing to keep between visits: registering issues a fresh key and retires your oldest one once you hold the maximum, so a lost or leaked key is replaced by repeating the steps above. A retired key stops authenticating immediately, so move an integration onto its new key before you register again.

Limits


Key lifetime	30 days from issue
Keys per email address	2 active at a time
Rate limit	10 requests per minute, 300 per day

Treat a Sandbox key as a secret even though the data behind it is test data. Do not put it in browser code, source control, logs, support tickets, or email.

What a Sandbox key can do

A Sandbox key reads fixed test data through the 15 read-only endpoints listed in What a Sandbox key can call. The Sandbox reference documents the whole build, so most of what it lists is out of reach: anything that writes - creating organizations, inviting members, issuing certificates, sending email - answers 403 This endpoint is not available in the sandbox., and so do some reads. Every endpoint a Sandbox key cannot call says so in its title. A Sandbox identity also authenticates with the soxai-api-key header only. A Firebase ID token issued to a Sandbox account is refused with 403. See Sandbox for how Sandbox behavior differs from Production.

Get started

API Reference (Sandbox)

API Reference (Production)

About

Replacing a key

Limits

What a Sandbox key can do