Introduction
Sandbox OAuth clients let you finish the full flow — login, consent, demo trades, sockets, and webhooks — without real money. The client id prefix is partner_test_*. Keep partner_live_* off laptops and CI logs.
Demo wallets can be recharged in Trade. Nothing you do in sandbox creates partner commission, so a buggy double-order cannot create a payout you then have to reverse.
Checklist
- In Referrals, open Apps and create a sandbox app. Use a redirect URI such as
http://localhost:5174/callback(example app) or your own callback path. Copy the secret once. - Store id and secret in server env vars, not in git or the Vite bundle.
- Complete OAuth with a test Coinpes user and call
GET /v1/accounts. You should see a demo wallet. - Place a demo order with
accountType: "demo"and anIdempotency-Key. Confirm it in your UI and in Trade. - Connect WebSocket via
POST /v1/ws-tokenand prove quotes move. - Add a webhook in Referrals pointing at a public HTTPS tunnel. Use Test on the row to send a signed sample before you wait for a live fill.
Local webhooks
Coinpes cannot POST to http://127.0.0.1. Expose your handler with a tunnel, register that HTTPS URL, then run Test. Check the delivery log for status and HTTP code. Fix signature verification here — production events use the same HMAC.
What sandbox cannot do
- Operate on real wallets.
- Generate commission (demo never pays).
- Share a live client secret — keep
partner_live_*on production hosts only.
Go-live gate
Switch clients only when OAuth, a demo fill, a socket reconnect, and a webhook Test all succeed. Then point production at the live client and keep sandbox credentials in a separate env file.
Redirect URIs must match character for character. A trailing slash mismatch fails the entire OAuth redirect.
When the checklist is green, clone the example app, reskin it, and deploy from GitHub: Clone and deploy the example app.
Diagrams and notes: Sandbox setup.
