> ## Documentation Index
> Fetch the complete documentation index at: https://developers.soxai.co.jp/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a Sandbox API key

> Register an email address and receive an API key for the SOXAI API Sandbox.

This page issues credentials for the **Sandbox** only (`https://web-api.dev.soxai.site`). A Sandbox key never authenticates against Production. To use Production, [request access](https://developers.soxai.co.jp/support.md#request-production-access).

**1. Register an email address**

The Sandbox identity is passwordless. Choose the role it should hold, and a link is emailed to you. The link is valid for 60 minutes.

<form>
  Email address

  Role

  The role is fixed for this identity. Register a second address to try
  the other one.

  Send my API key
</form>

**2. Open the link in the email**

The link issues your API key and displays it once. **Copy it before closing that page** - the key is stored as a hash, so nothing, including this site, can show it to you again. Lose it and you register again for a new one.

**3. Look up your uid and org\_id**

Data endpoints take a UID in the path, and org-scoped endpoints take an `org_id`.
Both come from `GET /api/myOrg`, which reads them from the key itself and takes no
parameter. Call it first:

```bash theme={null}
curl 'https://web-api.dev.soxai.site/api/myOrg' \
  -H 'soxai-api-key: YOUR_SANDBOX_KEY'
```

```json theme={null}
{
  "isOrgUser": true,
  "uid": "user123",
  "email": "you@example.com",
  "myOrg": {
    "orgId": "org_ab12cd34",
    "orgName": "SOXAI Research"
  }
}
```

`uid` is your own UID and `myOrg.orgId` is the `org_id` every org-scoped endpoint takes.

**4. Call the Sandbox with the key**

Send the key in the `soxai-api-key` request header, and use the UID from the previous
step in the path:

```bash theme={null}
curl -G 'https://web-api.dev.soxai.site/api/v2/DailyInfoData/user123' \
  --data-urlencode 'start_day=2026-01-01' \
  --data-urlencode 'end_day=2026-01-31' \
  -H 'soxai-api-key: YOUR_SANDBOX_KEY'
```

## Replacing a key

Register the same address again. There is no separate revoke step and nothing to keep between visits: registering issues a fresh key and retires your oldest one once you hold the maximum, so a lost or leaked key is replaced by repeating the steps above.

A retired key stops authenticating immediately, so move an integration onto its new key before you register again.

## Limits

| | |
| - | - |
| Key lifetime | 30 days from issue |
| Keys per email address | 2 active at a time |
| Rate limit | 10 requests per minute, 300 per day |

> [!WARNING]
>
> Treat a Sandbox key as a secret even though the data behind it is test data. Do not put it in browser code, source control, logs, support tickets, or email.

## What a Sandbox key can do

A Sandbox key reads **fixed test data** through the 15 read-only endpoints listed in [What a Sandbox key can call](https://developers.soxai.co.jp/guides/sandbox.md#what-a-sandbox-key-can-call). The Sandbox reference documents the whole build, so most of what it lists is out of reach: anything that writes - creating organizations, inviting members, issuing certificates, sending email - answers `403 This endpoint is not available in the sandbox.`, and so do some reads. Every endpoint a Sandbox key cannot call says so in its title.

A Sandbox identity also authenticates with the `soxai-api-key` header only. A Firebase ID token issued to a Sandbox account is refused with `403`.

See [Sandbox](https://developers.soxai.co.jp/guides/sandbox.md) for how Sandbox behavior differs from Production.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.