Skip to main content

Pilot Onboarding

Controlled pilot only: The external sandbox API hostname is live for approved foundation pilots. Sparelane issues credentials directly before access is granted.

What Sparelane Provides​

For an approved foundation pilot, Sparelane will provide:

  • The sandbox API base URL: https://api.sandbox.sparelane.com.au/v1.
  • One merchant-scoped sandbox API key.
  • A contact path for support and emergency key revocation.
  • The current OpenAPI specification and Postman collection.
  • Confirmation that all data and payments are fictional.

API keys identify the merchant automatically. Do not send a merchantId to select a tenant.

Requesting Access​

Sandbox access is approved manually. Send Sparelane:

  • Legal or trading name for the organisation.
  • Primary technical contact name and email.
  • Support or operations email for sandbox notices.
  • Expected integration use case and approximate test volume.
  • Confirmation that only fictional data will be used.

Sparelane creates the sandbox merchant and issues credentials directly to the authorised technical contact. There is no public self-service registration.

Key Expiry And Rotation​

Sandbox API keys are time-limited. Sparelane will confirm the expiry date when the key is issued. If a key is exposed, a pilot ends, or a technical contact changes, ask Sparelane to revoke or rotate the key.

Never paste a working API key into browser JavaScript, public repositories, issue trackers, screenshots or support chats.

First Smoke Test​

After receiving a sandbox key, make a read-only identity request:

curl "$BASE_URL/merchant" \
  -H "Authorization: Bearer $API_KEY" \
  -H "x-request-id: pilot-smoke-0001"

Expected result:

  • HTTP 200.
  • A merchant profile matching the pilot merchant.
  • A sparelane-request-id response header.
  • Rate-limit headers.

If the key is missing, invalid, expired or revoked, the API returns JSON 401 errors. Error bodies should not include secrets, stack traces or database details.

Tenant Isolation Check​

Merchant API keys can access only their own merchant resources. Requests for another merchant's customer, bill, payment, mandate or webhook records return 404 rather than revealing whether that resource exists.

Safe Test Data​

Use only fictional customer names, emails, bills, webhook URLs and payment scenarios. The sandbox does not move money and must not receive real card numbers, CVVs, bank credentials or production customer data.

Webhook Testing​

Webhook endpoint registration requires HTTPS. Localhost, private-network, link-local and metadata destinations are rejected. Test webhook payload generation is available without delivering a live webhook request.

Emergency Stop​

If a pilot credential is exposed or no longer needed, ask Sparelane to revoke it. Once revoked, the key cannot authenticate and a replacement key must be issued separately.