# Sandbox Environment

This page covers the sandbox-specific values you'll need when making API requests. It assumes you have already [created an app](getstarted.md) and have received a `clientId` and `clientSecret`. 

#### Sandbox Hosts

* **Authentication base URL:** https://oauth.sandbox.openbankingplatform.com 
* **API base URL:** https://api.sandbox.openbankingplatform.com 

:::warning

Note that the authentication base URL in sandbox uses an `oauth` prefix, while production uses `auth`.

:::

#### Access Token Scopes

The sandbox uses the same `scope` values for access tokens as production, except the [ASPSP Information Service](list_banks.md), where you should use `accountinformation` instead. 

#### PSU Identifiers

You can generally set `PSU-ID` and `PSU-Corporate-ID` to any value of your choice in your API requests. However, there are specific identifiers that you can use to test negative scenarios:

**Values for `PSU-ID`**

| `PSU-ID` Value | API              | Scenario                                                                                  | Message Code                     |
| -------------- | ---------------- | ----------------------------------------------------------------------------------------- | -------------------------------- |
| `99990101001`  | Consent          | Authorisation fails due to the PSU having insufficient permissions in the online bank.    | `PSU_RIGHTS_MISSING`             |
| `99990101002`  | PIS              | Authorisation successful but authorisation by a second PSU is required.                   | `AUTHORISATION_PENDING_API`      |
| `99990101003`  | Consent          | Authorisation successful but authorisation by a second PSU is required.                   |  N/A                             |
| `99990101004`  | Consent & PIS    | Authorisation fails due to the session expiring before PSU can authenticate.              | `AUTHENTICATION_SESSION_EXPIRED` |
| `99990101005`  | Consent & PIS    | Authorisation fails due BankID not being activated at the bank.                           | `BANKID_NOT_ACTIVATED`           |

**Values for `PSU-Corporate-ID`**

| `PSU-Corporate-ID` Value | API | Scenario                      |
| ------------------------ | --- | ----------------------------- |
| Ends in odd digit        | KYC | KYC returns `Invalid` status. |

#### Creditor Accounts

Use the IBANs below to test Verification of Payee (VoP) scenarios in the sandbox — either in the [PIS](quickstart_pis.md#response-2) or in the dedicated [VoP API](vop.md). Each IBAN has a registered name and the VoP result returned depends on how closely the name you submit matches it. Any other IBAN will always return `MTCH` regardless of the submitted name.

| IBAN                     | Name                         |
| ------------------------ | ---------------------------- |
| SE4550000000058398257466 | Acme Corp AB                 |
| FI7521123456700081       | Nordic Steel Supplies Oy     |
| NO4693861111222          | Baltic Freight Solutions AS  |
| DK3250004004024940       | Global Logistics A/S         |
| NL91ABNA0417164300       | Groot Facility Services B.V. |