# Sandbox workspaces

> Build and test an integration against a separate workspace flagged as a sandbox — pc_test_ keys, the same base URL, data isolated from your live workspace.

Source: https://developers.processcart.com/guides/sandbox

A sandbox is a **separate workspace** you build and test an integration in before it touches live data. It is a whole workspace of its own — its own workflows, runs, members and keys — with one flag set in Settings → API.

## The two-account flow

1. **Sign up a second account** (or have a colleague do it) and create a workspace for testing — "Acme sandbox".
2. In that workspace, open **Settings → API** and switch on **This workspace is a sandbox**. An Admin can flip it; the change is audited.
3. Create API keys there. Keys minted while the flag is on carry the **`pc_test_`** prefix, and `GET /v1/me` reports `"sandbox": true` for them. Existing keys keep the prefix they were minted with.
4. Import your real workflows into the sandbox with `GET /v1/workflows/{id}/template` on the live workspace and `POST /v1/workflows` on the sandbox — the portable template carries the whole buildable workflow ([Workflows & schema](https://developers.processcart.com/guides/workflows)).
5. Point your integration at the sandbox key. **The base URL is the same** (`https://app.processcart.com/api/v1`); only the key decides which workspace you are in.

Data stays isolated per workspace: a sandbox never sees another workspace's runs, members or webhooks, and nothing you do there reaches your live workspace. Webhooks registered in the sandbox deliver sandbox events only.

## What a sandbox does not change

- Limits are the same (600 requests per minute per key).
- Email still sends if the sandbox workspace has email configured — leave it on the shared sending mode or point it nowhere while testing.
- A key always acts on the workspace that minted it, whatever its prefix: the prefix only records whether that workspace was flagged as a sandbox when the key was minted. A key minted in the sandbox can never read or change the live workspace's data, and a key minted in the live workspace never touches the sandbox — so a sandbox key minted before the flag was switched on still reads `pc_live_`, and still acts on the sandbox only.

When you are ready, mint a `pc_live_` key in the live workspace and swap it in; the requests do not change.