# Sandbox Credentials

This page covers the sandbox-specific values you'll need when making API requests. It assumes you have already [created an app](getstarted.md) and have received a `clientId` and `clientSecret`. 

#### Sandbox URLs

* **Authentication base URL:** https://auth.sandbox.openbankingplatform.com 
* **API base URL:** https://api.sandbox.openbankingplatform.com 

#### PSU Identifiers

In your API requests, you can generally set `PSU-ID` and/or `PSU-Corporate-ID` to any value of your choice. However, there are specific identifiers that you can use to test negative test scenarios:

**Values for `PSU-ID`**

| `PSU-ID` Value | API              | Scenario                                                                                  | Message Code                     |
| -------------- | ---------------- | ----------------------------------------------------------------------------------------- | -------------------------------- |
| `99990101001`  | Consent          | Authorisation fails due to the PSU having insufficient permissions in the online bank.    | `PSU_RIGHTS_MISSING`             |
| `99990101002`  | PIS              | Authorisation successful but authorisation by a second PSU is required.                   | `AUTHORISATION_PENDING_API`      |
| `99990101003`  | Consent          | Authorisation successful but authorisation by a second PSU is required.                   |  N/A                             |
| `99990101004`  | Consent & PIS    | Authorisation fails due to the session expiring before PSU can authenticate.              | `AUTHENTICATION_SESSION_EXPIRED` |
| `99990101005`  | Consent & PIS    | Authorisation fails due BankID not being activated at the bank.                           | `BANKID_NOT_ACTIVATED`           |

**Values for `PSU-Corporate-ID`**

| `PSU-Corporate-ID` Value | API | Scenario                      |
| ------------------------ | --- | ----------------------------- |
| Ends in odd digit        | KYC | KYC returns `Invalid` status. |