The sandbox

There is no separate sandbox host and no second account to create. The key you use decides which world you are in, and a sk_test_ key gives you a faithful rehearsal of the real thing.

What stays exactly the same

This is the point of it. A sandbox document goes through the same pipeline as a real one: the same PDF conversion, the same field placement, the same signing page, the same PAdES sealing, the same audit certificate. It also fails for the same reasons - a signer with no signature field is rejected in the sandbox exactly as it would be live, so you find that bug on a Tuesday afternoon rather than in front of a customer.

What changes

• No email leaves the building. Signature requests, reminders, decline notices and completion copies are all suppressed for test documents. You cannot accidentally mail a stranger from a loop that ran one time too many.
• The signed PDF is watermarked. Every page carries a diagonal SANDBOX - NOT LEGALLY BINDING stamp, so a test document can never be mistaken for an executed contract, including by someone who receives it out of context.
• Nothing counts against your plan. Test sends skip the monthly and daily allowance entirely.
• Nothing is billed. No usage record is written, so sandbox traffic never reaches an invoice.
• Webhooks stay in their lane. A test document only reaches endpoints created with a test key. Endpoints are bound to a mode when they are created and cannot be moved between them.

Knowing which mode you are in

curl https://api.documentesign.com/v1/account \
  -H "Authorization: Bearer $ESIGN_API_KEY" | jq .mode

Every document you read back also carries a mode field, so you never have to infer it.

The isolation is real

Test and live documents are not tagged copies of each other in one pile - they are invisible to one another. A live key listing documents will not see a single sandbox row, and fetching a sandbox id with a live key returns 404 rather than 403, so the live key cannot even confirm the document exists. The mode is written when the document is created and is never changed afterwards, so there is no window in which a test document looks live.

Going to production

Mint a sk_live_ key and change one environment variable. The base URL and every endpoint, field name and response shape are identical, so there is no second integration to write and no code path that only runs in production.

- ESIGN_API_KEY=sk_test_...
+ ESIGN_API_KEY=sk_live_...

Confirm with GET /account that mode now reads LIVE, and read errors and limits before you turn on real volume.