> For the complete documentation index, see [llms.txt](https://docs.kydlabs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kydlabs.com/authentication/sandbox-testing.md).

# Sandbox Environment

Sandbox mode lets you build and validate a Fan API integration against KYD's production OAuth and API endpoints without using real fans or production ticket inventory.

## Client Modes

Sandbox and production are modes on an OIDC client.

* `mode: "sandbox"` lets an integration exercise the production OAuth flow with test users and test tickets.
* `mode: "production"` uses production users and production ticket data.

In sandbox:

* KYD issues an OIDC client with `mode: "sandbox"`.
* Test users have generated phone numbers, verification codes, and wallet addresses.
* Fan OAuth login uses the test user's generated phone number and code instead of sending SMS.
* Test events are registered on [Solana devnet](https://learn.backpack.exchange/articles/what-is-solana-devnet) program.
* Permits can be issued on-chain to test user wallets.

## Recommended Scopes

For listing partner integrations, use:

```
openid profile offline_access fan:tickets:read fan:listings:write
```

## Test User Login

KYD provides sandbox test users with a generated `phone_number` and static verification `code`. Use those values in the hosted OAuth UI when testing a sandbox client. No SMS is sent in sandbox.

## Test Tickets

Sandbox tickets are backed by test events and permits. A permit grants a test user access to a test event ticket, which makes that ticket visible from the Fan API after the user authorizes your app.

`GET /tickets` returns sandbox inventory when called with a sandbox access token:

```http
GET https://api.kydlabs.com/fans/tickets HTTP/1.1
Authorization: Bearer <ACCESS_TOKEN>
```

## Testing The OAuth Flow

1. Get a sandbox OIDC client from KYD with your callback URL and Fan scopes.
2. Get a sandbox test user with a phone number and verification code.
3. Confirm the test user has at least one test permit.
4. In your app, start `/oauth2/authorize` with the sandbox client ID, redirect URI, scopes, state, and PKCE challenge.
5. On the hosted login UI, enter the test user's phone number and generated code.
6. Approve the requested actions and ticket access.
7. Exchange the returned code at `/oauth2/token`.
8. Call KYD Fan APIs with the bearer access token.

The access token will include:

```json
{
  "aud": "kyd-api",
  "mode": "sandbox",
  "granted_actions": ["fan:tickets:read", "fan:listings:write"]
}
```

## Moving To Production

When your integration is ready, KYD reviews and enables a production client. The OAuth and Fan API endpoints stay the same; the production client issues tokens with `mode: "production"` and Fan API calls operate on production users and ticket inventory.