Sandbox and production
Sandbox is the merchant plus the key prefix, on the same host. Forced failure scenarios are named; there is no flag that fabricates an approval.
Forced failures
Sandbox keys accept the header x-sidaxis-scenario. Live keys ignore it.
| Scenario | What it injects |
|---|---|
success | Nothing at all — the real engine runs and needs a real face |
liveness_fail | The capture fails liveness: 403 BIOMETRIC_LIVENESS_FAILED |
vrc_coerced | A coercion signal: 403 COERCION_DETECTED |
subject_mismatch | The face does not match the claimed subject: 403 IDENTITY_MISMATCH |
duplicate_enroll | An identity already exists for this face |
The one real difference
Sandbox skips blockchain anchoring, so sandbox receipts come out without a public seal. Everything else — refusal reasons, assurance levels, ceilings, webhooks — behaves as in production.
Sidaxis is the human authorisation layer. It never moves money, holds funds or settles. The machine-readable contract is openapi.yaml.