Build on Bookatu safely with a booking API sandbox
A sandbox is a test business with sample data and bk_test_ keys. Partners and agencies can test a booking API integration without real clients or real money.
If you build booking tools for salons, spas or clinics, you may have tested on a real business before. A practice booking lands in a real calendar, and a confirmation reaches a real inbox. A sandbox ends that: it is a test business inside Bookatu, and nothing it does reaches a real client or moves real money.
What a sandbox is
Each sandbox is a business of its own, with its own slug, so the calls you would make to a live business work on it unchanged. A Test mode banner runs across its admin, and a Test business ribbon on its booking page asks visitors not to enter real personal details. It is never listed anywhere public, never indexed and never billed.
How to make a sandbox
- 01Sign in
Use any confirmed Bookatu login. You don't need a business on Bookatu.
- 02Open your sandboxes
Go to /developers/sandbox. You can have up to three at a time.
- 03Pick the basics
Choose a name, a time zone and a currency, and accept the test-mode terms.
- 04Keep the first key
It comes with the sandbox, has every scope, lasts 90 days and is shown once.
Prefer code? POST /api/developer/sandboxes makes one, signed in with your Bookatu login rather than an API key.
What is already in it
A new sandbox has three team members, seven services and five made-up clients, with bookings past and upcoming, a class and a waitlist entry. One service takes a deposit and one asks a booking question. Every client email is at an example domain, and every phone number is in a range kept for fiction. Times are in your zone and prices in your currency. A reset puts it all back and keeps your keys, webhook endpoints and connected apps.
Test keys, live keys and livemode
A sandbox issues only test keys, which start bk_test_. A live business issues only live keys, which start bk_live_. Send either to the wrong kind of business and the call is refused with 403 LIVEMODE_MISMATCH before anything runs, on every endpoint, the keyless ones included.
Every answer from a sandbox carries the Bookatu-Livemode header, and every JSON answer says livemode: false. Building a front end on the keyless endpoints? Send Bookatu-Livemode: false with each request, and a test build can never book at a real business.
curl https://bookatu.com/api/v1/sbx-k3v9q2m1/services -H "Bookatu-Livemode: false"What leaves a sandbox, and what never does
Every email, text, WhatsApp message and push notification it would send is kept in its test outbox. Read it in the admin, or with GET /api/v1/{slug}/sandbox/outbox. Payments go to a test checkout with buttons, never a card number.
Two things do leave: webhooks to the endpoints you register, marked livemode: false, and an email to you a week before an unused sandbox is deleted. It goes after 30 days with no API call on its keys and no visit to its admin.
Questions owners ask
Will my developer's testing ever reach my clients?
No. A sandbox has its own made-up clients, its messages stay in its outbox, and a test key can't be used on your business at all.
Does my agency need my login to build for me?
No. They build against a sandbox made with their own login. When it works, you or an admin on your team make them a live key, with only the scopes they need.
Can a sandbox become my real booking page?
No. A sandbox can never be turned into a live business, and a live business can never become a sandbox.
Where to start
Make a sandbox, list its services with the test key, book a time and read the confirmation in the outbox. Our developer guides Testing with a sandbox and Going live cover the rest. Our post AI agents and your booking data: what a key lets in, and what it never touches explains keys for owners.
