Sandbox Environment

Test your app against a fully-featured sandbox with sample data before going to production.

Overview

Every developer account gets an automatically provisioned sandbox organization. The sandbox mirrors the production environment with pre-populated test data, so you can develop and test your integration without affecting real brokerage data.

Sandbox Details

Getting Started

Your sandbox is ready as soon as you register as a developer. No additional setup needed.

1. Create your app in the developer dashboard
2. Install the app on your sandbox organization
3. Complete the OAuth flow using the sandbox auth URL
4. Make API calls against the sandbox API base URL

Test Data

The sandbox comes pre-populated with:

Test data is reset weekly to the default state. You can also trigger a manual reset from the developer dashboard.

Switching Between Sandbox and Production

Use environment variables to control which environment your app targets:

import { LendWorksClient } from '@lendworks/sdk-node'

const client = new LendWorksClient({
  accessToken: process.env.LENDWORKS_ACCESS_TOKEN,
  baseUrl: process.env.NODE_ENV === 'production'
    ? 'https://api.lend.works/v1'
    : 'https://sandbox.api.lend.works/v1',
})

Or manage it through your app configuration:

const config = {
  development: {
    apiBaseUrl: 'https://sandbox.api.lend.works/v1',
    authUrl: 'https://sandbox.auth.lend.works',
  },
  production: {
    apiBaseUrl: 'https://api.lend.works/v1',
    authUrl: 'https://auth.lend.works',
  },
}

const env = config[process.env.NODE_ENV] || config.development

Webhook Testing

Sandbox webhook deliveries work identically to production. For local development, you can use a tunneling service to expose your local endpoint:

# Using a tunnel to receive webhooks locally
npx localtunnel --port 3000 --subdomain my-lw-app

Then set your webhook URL to https://my-lw-app.loca.lt/webhooks/lendworks in your app settings.

Sandbox Limitations

The sandbox is functionally identical to production with these exceptions:

• No real notifications — Email and SMS notifications are suppressed
• No external integrations — Third-party service calls (e.g., credit checks) return mock responses
• Weekly data reset — Test data resets to defaults every Sunday at midnight UTC
• No SLA — Sandbox availability is best-effort (though historically 99.9%+)

Best Practices

• Test the full OAuth flow in sandbox before submitting for review
• Verify webhook signatures work correctly with sandbox-issued secrets
• Test error handling — The sandbox supports the same error responses as production
• Test scope restrictions — Verify your app handles 403 responses gracefully when accessing resources outside its granted scopes
• Use sandbox for CI/CD — Run integration tests against the sandbox in your deployment pipeline
• Reset data before demos — Trigger a manual reset to start with clean, predictable test data