/
Contact usSee pricingStart building
Node
​

    About Stytch

    Introduction
    Integration Approaches
      Full-stack overview
      Frontend (pre-built UI)
      Frontend (headless)
      Backend
    Migrations
      Migration overview
      Migrating users statically
      Migrating users dynamically
      Additional migration considerations
      Zero-downtime deployment
      Defining external IDs for users
      Exporting from Stytch
    Custom Domains
      Overview

    Authentication

    DFP Protected Auth
      Overview
      Setting up DFP Protected Auth
      Handling challenges
    Magic Links
    • Email Magic Links

      • Getting started with the API
        Getting started with the SDK
        Replacing your password reset flow
        Building an invite user flow
        Add magic links to an existing auth flow
        Adding PKCE to a Magic Link flow
        Magic Link redirect routing
    • Embeddable Magic Links

      • Getting started with the API
    MFA
      Overview
      Backend integration
      Frontend integration
    Mobile Biometrics
      Overview
    M2M Authentication
      Authenticate an M2M Client
      Rotate client secrets
      Import M2M Clients from Auth0
    OAuth
    • Identity providers

      • Overview
        Provider setup
      Getting started with the API (Google)
      Add Google One Tap via the SDK
      Email address behavior
      Adding PKCE to an OAuth flow
    Connected AppsBeta
      Setting up Connected Apps
      About Remote MCP Servers
    • Resources

      • Integrate with AI agents
        Integrate with MCP servers
        Integrate with CLI Apps
    Passcodes
      Getting started with the API
      Getting started with the SDK
    • Toll fraud

      • What is SMS toll fraud?
        How you can prevent toll fraud
      Unsupported countries
    Passkeys & WebAuthn
    • Passkeys

      • Passkeys overview
        Set up Passkeys with the frontend SDK
    • WebAuthn

      • Getting started with the API
        Getting started with the SDK
    Passwords
      Getting started with the API
      Getting started with the SDK
      Password strength policy
    • Email verification

      • Overview
        Email verification before password creation
        Email verification after password creation
    Sessions
      How to use sessions
      Backend integrations
      Frontend integrations
      Custom claims
      Custom claim templates
      Session tokens vs JWTs
      How to use Stytch JWTs
    TOTP
      Getting started with the API
      Getting started with the SDK
    Web3
      Getting started with the API
      Getting started with the SDK

    Authorization

    Implement RBAC with metadata

    3rd Party Integrations

    Planetscale
    Supabase
    Feathery
    Unit

    Testing

    E2E testing
    Sandbox values
Get support on SlackVisit our developer forum

Contact us

Consumer Authentication

/

Guides

/

Testing

/

Sandbox values

Testing

Stytch provides sandbox values which can be used to receive sample responses in the Test environment. The sandbox values below are only available when calling the Stytch API directly. They will not work when used with a frontend or mobile Stytch SDK.

Magic Links

In some scenarios, it may be helpful to test sending a magic link without actually sending an email. You can use the email address sandbox@stytch.com to test sending a magic link. If your API credentials and the request format are correct you will receive a 200 status response, but no email will actually be sent.

You can use the following tokens in the /magic_links/authenticate endpoint and receive the corresponding responses.

  • 200 Success: DOYoip3rvIMMW5lgItikFK-Ak1CfMsgjuiCyI7uuU94=
  • 401 unable_to_auth_magic_link: 3pzjQpgksDlGKWEwUq2Up--hCHC_0oamfLHyfspKDFU=
  • 404 magic_link_not_found: CprTtwhnRNiMBiUS2jSLcWYrfuO2POeBNdo5HhW6qTM=

One-time Passcodes (OTP)

In some scenarios, it may be helpful to test sending a One-time Passcode (OTP) without actually sending a message. You can use the phone number +10000000000, for our /otps/sms/send and /otps/whatsapp/send endpoints, and sandbox@stytch.com for our /otps/email/send endpoint, to test sending an OTP in our Test environment. If your API credentials and the request format are correct, you will receive a 200 status response but no message will actually be sent.

You can use the following code, and the method_id you received in the 200 response from /otps/xxx/send, in the /otps/authenticate endpoint and receive the corresponding response.

  • 200 Success: 000000

OAuth Logins

The following tokens can be used in order to test the /v1/oauth/authenticate endpoint.

  • 200 Success: hdPVZHHX0UoRa7hJTuuPHi1vlddffSnoweRbVFf5-H8g
  • 400 oauth_token_not_found: 59cnLELtq5cFVS6uYK9f-pAWzBkhqZl8AvLhbhOvKNWw

Session Management

You can use the following session_tokens to test the /sessions/authenticate endpoint.

  • 200 Success: WJtR5BCy38Szd5AfoDpf0iqFKEt4EE5JhjlWUY7l3FtY
  • 404 session_not_found: 59cnLELtq5cFVS6uYK9f-pAWzBkhqZl8AvLhbhOvKNWw

Passwords

If you pass the email address sandbox@stytch.com into the /passwords or the /passwords/authenticate endpoints, you will receive a 200 response regardless of the password value specified.

If you pass the email address sandbox@stytch.com into the /passwords/email/reset/start endpoint, you will receive a 200 response without sending an actual password reset email.

You can use the following token values to test the /passwords/email/reset endpoint:

  • 200 Success: Xh8QnB4h_9Qe0d1DQcFAoW6rImuq4wBQZ-hHtwzFIg_E
  • 401 unable_to_auth_magic_link: alpFprsAkyUy_Pg3WWYlKL-yGgYXspnJo0SbS3-Djuij

Crypto Wallets

The following crypto wallet address can be used in order to test the /v1/crypto_wallets/authenticate/start and /v1/crypto_wallets/authenticate endpoints along with the ethereum wallet type.

  • 200 Success: 0x6df2dB4Fb3DA35d241901Bd53367770BF03123f1-H8g

Time-based One-time Passcodes (TOTP)

To test the creation of TOTPs you can use the following user_id in the Test environment with the /v1/totps endpoint. You can use the same user_id to test /v1/totps/recovery_codes as well.

  • user_id: user-test-e3795c81-f849-4167-bfda-e4a6e9c280fd

You can use the following totp_codes along with the above user_id to test the /v1/totps/authenticate endpoint.

  • 200 Success: 000000
  • 401 unable_to_authenticate_totp: 401401

You can use the following recovery_codes along with the above user_id to test the /v1/totps/recover endpoint.

  • 200 Success: a1b2-c3d4-e5f6
  • 401 unable_to_authenticate_recovery_code: 0u1v-2w3x-4y5z

Magic Links

One-time Passcodes (OTP)

OAuth Logins

Session Management

Passwords

Crypto Wallets

Time-based One-time Passcodes (TOTP)