# Sandbox and production

Sandbox is the merchant plus the key prefix, on the same host. Forced failure scenarios are named; there is no flag that fabricates an approval.

> There is no sandbox host. Same base URL, same tables. Sandbox is `sk_test_` / `pk_test_` on a sandbox merchant, and isolation is by `merchant_id`.

## Forced failures

Sandbox keys accept the header `x-sidaxis-scenario`. Live keys ignore it.

| Scenario | What it injects |
| --- | --- |
| success | Nothing at all — the real engine runs and needs a real face |
| liveness_fail | The capture fails liveness: 403 BIOMETRIC_LIVENESS_FAILED |
| vrc_coerced | A coercion signal: 403 COERCION_DETECTED |
| subject_mismatch | The face does not match the claimed subject: 403 IDENTITY_MISMATCH |
| duplicate_enroll | An identity already exists for this face |

> The sandbox never fabricates an approval. This is the honest-proof rule applied to test data, and it is why there is no “always approve” flag.

## The one real difference

Sandbox skips blockchain anchoring, so sandbox receipts come out without a public seal. Everything else — refusal reasons, assurance levels, ceilings, webhooks — behaves as in production.