---
title: "Build on Bookatu safely with a booking API sandbox"
description: "A sandbox is a test business with sample data and bk_test_ keys. Partners and agencies can test a booking API integration without real clients or real money."
url: "https://bookatu.com/en-nz/blog/booking-api-sandbox-for-partners-and-agencies"
language: "en"
section: "Blog"
category: "Grow your business"
author: "The Bookatu team"
published: "2026-10-30"
updated: "2026-10-30"
tags: ["booking api sandbox", "test booking api", "api test keys", "test mode for developers", "booking integration for agencies"]
---

# Build on Bookatu safely with a booking API sandbox

A sandbox is a test business with sample data and bk_test_ keys. Partners and agencies can test a booking API integration without real clients or real money.

> **The short version**
>
> - A sandbox is a test business of your own, with sample staff, services, clients and bookings.
> - It answers the same API, with the same booking rules, as a live business.
> - Its keys start bk_test_, and a test key sent to a live business is refused.
> - Messages go to a test outbox, and payments are simulated.

If you build booking tools for salons, spas or clinics, you may have tested on a real business before. A practice booking lands in a real calendar, and a confirmation reaches a real inbox. A sandbox ends that: it is a test business inside Bookatu, and nothing it does reaches a real client or moves real money.

## What a sandbox is

Each sandbox is a business of its own, with its own slug, so the calls you would make to a live business work on it unchanged. A Test mode banner runs across its admin, and a Test business ribbon on its booking page asks visitors not to enter real personal details. It is never listed anywhere public, never indexed and never billed.

## How to make a sandbox

1. **Sign in.** Use any confirmed Bookatu login. You don't need a business on Bookatu.
2. **Open your sandboxes.** Go to /developers/sandbox. You can have up to three at a time.
3. **Pick the basics.** Choose a name, a time zone and a currency, and accept the test-mode terms.
4. **Keep the first key.** It comes with the sandbox, has every scope, lasts 90 days and is shown once.

Prefer code? POST /api/developer/sandboxes makes one, signed in with your Bookatu login rather than an API key.

## What is already in it

A new sandbox has three team members, seven services and five made-up clients, with bookings past and upcoming, a class and a waitlist entry. One service takes a deposit and one asks a booking question. Every client email is at an example domain, and every phone number is in a range kept for fiction. Times are in your zone and prices in your currency. A reset puts it all back and keeps your keys, webhook endpoints and connected apps.

## Test keys, live keys and livemode

A sandbox issues only test keys, which start bk_test_. A live business issues only live keys, which start bk_live_. Send either to the wrong kind of business and the call is refused with 403 LIVEMODE_MISMATCH before anything runs, on every endpoint, the keyless ones included.

Every answer from a sandbox carries the Bookatu-Livemode header, and every JSON answer says livemode: false. Building a front end on the keyless endpoints? Send Bookatu-Livemode: false with each request, and a test build can never book at a real business.

```sh
curl https://bookatu.com/api/v1/sbx-k3v9q2m1/services -H "Bookatu-Livemode: false"
```

## What leaves a sandbox, and what never does

Every email, text, WhatsApp message and push notification it would send is kept in its test outbox. Read it in the admin, or with GET /api/v1/{slug}/sandbox/outbox. Payments go to a test checkout with buttons, never a card number.

Two things do leave: webhooks to the endpoints you register, marked livemode: false, and an email to you a week before an unused sandbox is deleted. It goes after 30 days with no API call on its keys and no visit to its admin.

## Questions owners ask

### Will my developer's testing ever reach my clients?

No. A sandbox has its own made-up clients, its messages stay in its outbox, and a test key can't be used on your business at all.

### Does my agency need my login to build for me?

No. They build against a sandbox made with their own login. When it works, you or an admin on your team make them a live key, with only the scopes they need.

### Can a sandbox become my real booking page?

No. A sandbox can never be turned into a live business, and a live business can never become a sandbox.

## Where to start

Make a sandbox, list its services with the test key, book a time and read the confirmation in the outbox. Our developer guides Testing with a sandbox and Going live cover the rest. Our post AI agents and your booking data: what a key lets in, and what it never touches explains keys for owners.