Sandbox

The sandbox is a separate TrustInk environment for building and testing your integration. It runs the same API, the same signing page and the same signing engine as production.

Environment	API base URL	For
Sandbox	https://api-sandbox.trustink.io	development, tests, demos
Production	https://api.trustink.io	real documents

Credentials are per environment: a client created for the sandbox does not work in production, and the other way round. Create them in the portal under API credentials.

What differs

• Documents are for testing only. Sandbox signatures are made with the sandbox’s own certificate hierarchy, whose root carries the environment’s name, so a test document is never taken for a real one. Verify sandbox documents against the sandbox (POST /verify on the sandbox base URL); production’s verification does not recognise them as issued by TrustInk.
• Mail is sent. Invitations, reminders and one-time codes are sent by email, so use addresses you can read.

No personal data

Use made-up names and test documents in the sandbox, never real contracts or customers’ personal data.

Before you go live

• Your webhook endpoint verifies Trustink-Signature over the raw body, rejects old timestamps and drops event ids it has seen (webhooks).
• It answers 2xx within 10 seconds and handles the work afterwards.
• You cache access tokens until shortly before they expire.
• Signature fields land where you expect on every page size you send (coordinates).
• You handle EXPIRED, CANCELLED, FAILED and UPLOAD_REJECTED, not only DONE.
• You store the signed PDF and the evidence summary, or fetch fresh links with GET /cases/{caseId} when you need them: links expire.
• You switched the base URL and the credentials to production.