Sandbox Testing
Test your integration end-to-end against the sandbox before going live.
Spare provides separate environments for integration testing and live traffic. Use sandbox until you have completed certification and received production credentials.
Sandbox behavior
- Simulated bank authorization, no real actions taken at the institution
- Test data (accounts, providers) is documented in your sandbox dashboard
- Rate limits are relaxed compared to production
- Safe to run repeatedly, create and tear down consents freely
What to test
Run through the full Integration Flow at least once: authenticate, discover providers, create a consent, and complete authorization. Then exercise failure paths, rejected consent, expired authorization, and webhook retries.
Base URL
| Environment | Base URL |
|---|---|
| Sandbox | https://api.sandbox.tryspare.ae |
| Production | https://api.tryspare.ae |
See Integration Flow for your market's authentication details.
Switching environments
Point requests at the sandbox or production base URL and use the matching credential pair, sandbox and production each have their own App ID / API key.
export SPARE_BASE_URL="https://api.sandbox.tryspare.ae"Moving to production
Before switching to production:
- Complete Spare's go-live review
- Rotate to production App ID / API key pairs
- Update webhook endpoints to production URLs
- Verify redirect URLs are HTTPS and registered with Spare
Authentication header
Send x-tenant: UAE on every request (except JWKS), alongside Authorization: Bearer <access-token>. It routes the request to the correct regulatory context.
Key takeaways
- Sandbox simulates authorization outcomes, no real money moves and no real records are created.
- Rotate to production credentials only after go-live review.
- Swap the base URL and credential pair to move between sandbox and production; the integration code is otherwise unchanged.