A sandbox team lets you build on TAGBASE before you hold a single tag. Its tags are virtual, and you scan them from the dashboard. An emulated scan goes through the same API and gets the same verdicts as a tap on a physical chip.
What you can do
- Create tags in the dashboard or with the Tags API. A sandbox tag is ready to scan as soon as it exists.
- Emulate a scan on any tag. You choose what the chip reports, and the scan opens in a new browser tab, just like a tap opens it on a phone.
- Point a tag’s URL at your own app. Emulated scans then land on your endpoint with real scan parameters in the query string.
- Forward those parameters to the Verifications API
and get back real
pending,validandinvalidverdicts. - Mint API keys and register webhooks, as on a production team.
- See every verification on your dashboard as it happens.
Why use it
- Start right away. Sign-up is free and self-service. You can write your whole integration before you order a single tag.
- Test the failure cases. A genuine tag nearly always passes, so a physical tag rarely shows you the counterfeit path. In the sandbox you can send a copied or broken scan on purpose and build the page your users see when a check fails.
- Change things as you go. A virtual tag has no chip, so its URL stays editable. Move it from a tunnel to staging and back while you work.
- Go live unchanged. Sandbox and production use the same API. When your physical tags arrive, swap the sandbox key for a production key and your code keeps working.
Emulate a scan
- Sign up for a sandbox team.
- Open Tags and create a tag. Leave the URL blank to use the TAGBASE verification page, or enter an endpoint in your own app.
- Click Emulate Scan… on the tag’s row.
- Choose what the chip reports, then click Emulate Scan. The scan opens in a new tab.
| Scan | What it sends |
|---|---|
| Genuine | A fresh tap, the way a real chip answers it |
| Replayed | The previous tap again, the way a copied tag would send it. Available after the first scan |
| Invalid | Security values that no chip would ever send |
A genuine scan behaves like a real tap. The first one returns pending and
opens a session, and a second genuine scan completes it
with valid. Replayed and invalid scans return invalid, so your counterfeit
page gets a real workout.
Tags with a tamper seal also let you choose what the seal reports: Sealed, Resealed or Open.
Scans are emulated only from the dashboard. The API has no endpoint for them, so a script or a CI job can’t trigger one.
Point a tag at your app
A tag’s URL must be a public https:// address, and each tag needs its own
URL. Put {id} in it (https://your-app.example/t/{id}) and every tag gets a
unique URL that carries its id (see Tags).
If you build on a hosted platform such as Lovable, Replit or Vercel, use the
public URL it gives your app. If your app runs on localhost, expose it
through a tunnel such as ngrok and use the tunnel’s
https:// address.
Sandbox and production
Sandbox is a property of the team, so sandbox tags and production tags never share a team (see Resource model). A few things only work on one side:
- You can emulate scans only on sandbox tags. Production tags are scanned on real chips.
- Production teams and their physical tags come from TAGBASE. Contact TAGBASE when you’re ready to go live.