Skip to main content
The OpenFX Sandbox environment allows you to test API integrations without affecting production data or real funds. This guide covers everything you need to know to get started.

​
Overview

Sandbox is an isolated testing environment that mirrors production functionality. Use it to:
  • Test API integrations before going live
  • Validate trading workflows
  • Test deposit and withdrawal flows with simulated funds
  • Experiment with different trading scenarios

​
Getting started

​
Obtain Sandbox credentials

Contact your admin to create Sandbox API credentials from the dashboard by switching to the Sandbox environment.

​
Authentication

Sandbox uses the same authentication mechanism as production for both API keys and webhooks, with two small differences.

​
API requests

  • Sandbox API keys are prefixed with sandbox_.
  • All requests must include the x-app-mode: SANDBOX header.

​
Webhook signing keys

Sandbox webhook signing keys are prefixed with sandbox_ to distinguish them from production keys. This helps prevent accidentally mixing production and Sandbox webhook handlers.

​
Rate limits

Sandbox has the same rate limits as production — 30 requests per second across all combined endpoints — so your integration behaves correctly when going live. See Rate limits for details.

​
Best practices

  1. Use separate credentials — Never mix production and Sandbox credentials in your code.
  2. Environment variables — Store credentials in environment variables, not in source.
  3. Test edge cases — Use Sandbox to exercise error handling and edge cases.
  4. Webhook testing — Verify your webhook handlers process all event types correctly.
  5. Pre-launch checklist — Complete end-to-end testing in Sandbox before going live.

​
Differences from production

​
Troubleshooting

401 Unauthorized
  • Verify you’re using Sandbox credentials (prefixed with sandbox_).
  • Confirm the x-app-mode: SANDBOX header is included.
  • Check that the API key is correctly formatted in the header.
404 Not Found
  • Verify the organization ID in the request path.
  • Ensure the endpoint path is correct.

​
Moving to production

1

Request production credentials

Request production API credentials from your admin.
2

Swap credentials

Replace Sandbox credentials with production credentials (remove the sandbox_ prefix).
3

Update the x-app-mode header

Remove or update the x-app-mode header (use LIVE or omit entirely).
4

Switch webhook signing key

Update webhook signature verification to use the production signing key.
5

Validate with small trades

Perform final validation with small test transactions.