Pointing at it
Sandbox is the same host with a/sandbox prefix:
What you need
Sandbox credentials are separate from production ones, and a sandbox key does not work against production. Ask for both at the same time — see Access. You also want your webhook endpoint registered for sandbox before you start, because several steps announce themselves only that way. Test your endpoint covers reaching a handler you are still writing.How it differs from production
Outcomes are yours to choose. In production, whether an application is approved is the bank’s decision. In sandbox it follows from what you send — see Forcing outcomes. Timing is not representative. Sandbox settles in seconds what a real rail takes hours or days to do. Build your flow so that it tolerates waiting, and do not calibrate timeouts against what you see here. Accounts open with a balance. A sandbox account carries an opening float, so a payout can succeed before you have deposited anything. Read the balance rather than assuming it reflects only your own deposits.Forcing outcomes
Approval, rejection, and the values that produce each one.