# Sandbox

Build and test your integration with virtual tags and emulated scans.


A sandbox team lets you build on TAGBASE before you hold a single tag. Its tags
are virtual, and you scan them from the dashboard. An emulated scan goes through
the same API and gets the same verdicts as a tap on a physical chip.

## What you can do

- Create tags in the dashboard or with the [Tags API](/docs/api/tags). A sandbox
  tag is ready to scan as soon as it exists.
- Emulate a scan on any tag. You choose what the chip reports, and the scan
  opens in a new browser tab, just like a tap opens it on a phone.
- Point a tag's URL at your own app. Emulated scans then land on your endpoint
  with real scan parameters in the query string.
- Forward those parameters to the [Verifications API](/docs/api/verifications)
  and get back real `pending`, `valid` and `invalid` verdicts.
- Mint API keys and register [webhooks](/docs/api/webhooks), as on a
  production team.
- See every verification on your dashboard as it happens.

## Why use it

- **Start right away.** Sign-up is free and self-service. You can write your
  whole integration before you order a single tag.
- **Test the failure cases.** A genuine tag nearly always passes, so a physical
  tag rarely shows you the counterfeit path. In the sandbox you can send a
  copied or broken scan on purpose and build the page your users see when a
  check fails.
- **Change things as you go.** A virtual tag has no chip, so its URL stays
  editable. Move it from a tunnel to staging and back while you work.
- **Go live unchanged.** Sandbox and production use the same API. When your
  physical tags arrive, swap the sandbox key for a production key and your
  code keeps working.

## Emulate a scan

1. [Sign up for a sandbox team](/dashboard/sign-in).
2. Open **Tags** and create a tag. Leave the URL blank to use the TAGBASE
   verification page, or enter an endpoint in your own app.
3. Click **Emulate Scan…** on the tag's row.
4. Choose what the chip reports, then click **Emulate Scan**. The scan opens in
   a new tab.

| Scan | What it sends |
| --- | --- |
| Genuine | A fresh tap, the way a real chip answers it |
| Replayed | The previous tap again, the way a copied tag would send it. Available after the first scan |
| Invalid | Security values that no chip would ever send |

A genuine scan behaves like a real tap. The first one returns `pending` and
opens a [session](/docs/api/sessions), and a second genuine scan completes it
with `valid`. Replayed and invalid scans return `invalid`, so your counterfeit
page gets a real workout.

Tags with a tamper seal also let you choose what the seal reports: **Sealed**,
**Resealed** or **Open**.

Scans are emulated only from the dashboard. The API has no endpoint for them,
so a script or a CI job can't trigger one.

## Point a tag at your app

A tag's URL must be a public `https://` address, and each tag needs its own
URL. Put `{id}` in it (`https://your-app.example/t/{id}`) and every tag gets a
unique URL that carries its id (see [Tags](/docs/api/tags#the-url-attribute)).

If you build on a hosted platform such as Lovable, Replit or Vercel, use the
public URL it gives your app. If your app runs on `localhost`, expose it
through a tunnel such as [ngrok](https://ngrok.com) and use the tunnel's
`https://` address.

## Sandbox and production

Sandbox is a property of the team, so sandbox tags and production tags never
share a team (see [Resource model](/docs/overview/resource-model)). A few things
only work on one side:

- You can emulate scans only on sandbox tags. Production tags are scanned on
  real chips.
- Production teams and their physical tags come from TAGBASE.
  [Contact TAGBASE](mailto:contact@tagbase.io) when you're ready to go live.