Sandbox
What sandbox is for, how an order reaches each terminal state there, and how to receive your first webhook.
https://sandbox.onlink.africaSandbox is where you build and certify. It runs the same code as production: the same signing, the same nonce store, the same order lifecycle, the same webhook dispatcher and the same error codes. What differs is that value does not move on real rails, and the amounts are small.
What you can do here
- Sign requests and get real
401s when you get it wrong. - Take quotes off a live rate source.
- Create orders on both legs and drive them to a terminal state.
- Register and confirm withdrawal addresses.
- Receive real, signed webhooks at your own endpoint.
Driving an order to a terminal state
This is the question that stalls most evaluations on day two, so here is the honest answer for each ending.
| Ending | How to get there in sandbox |
|---|---|
expired | Create an order and leave it unfunded. Unfunded orders expire after their 24-hour window; a sweep marks them shortly after. |
settled | Fund the order, then ask us to release it. Sandbox settlement is not self-serve. |
rejected | Ask us to reject a funded order. |
Settling and rejecting are not self-serve yet
There is no sandbox endpoint that advances an order for you. To see
order.settled or order.rejected end to end, email
info@onlink.africa with the orderId and the
outcome you want, and we will drive it. It is a manual step and we would
rather say so than let you discover it by waiting.
order.expired needs nothing from us, so it is the fastest way to prove your
webhook handler works: create an order, do not fund it, and wait out the window.
Receiving your first webhook
You need an HTTPS endpoint we can reach. For a first delivery a public request-bin service is fine — you are checking that a signed request arrives and that your verifier accepts it, not moving value.
- Send us the URL and we register it, along with your signing secret.
- Trigger an event — an unfunded order that expires is the simplest.
- Verify the signature with the recipe in Verifying signatures.
Move to your own endpoint before you certify. A request bin will not exercise
your deduplication on X-OnLink-Delivery, and duplicate deliveries are normal.
Amounts
Keep test amounts small. Your per-order and rolling-24-hour caps apply in sandbox exactly as they do in production, and they are set per partner — the values are in your onboarding, not on this page.
Going to production
Production access is enabled per partner once your integration is certified. Nothing in your code changes but the base URL and your credentials. Talk to us when you are ready.