Test mode and magic test addresses

Create them in the console under Settings › Keys:

• a test secret API key: bs_test_… (the "Test key" box), for /verify, /siteverify, /feedback and /reviews;
• a test site key: bs_site_test_… (the "Test site key" box), for the browser script and /check.

The key decides the mode, per request: an account can use live and test keys side by side. The API host is the same, https://api.inlineshield.io. The former sandbox host, sandbox.api.inlineshield.io, now redirects to this page.

With a test key, these addresses always give the same result, without running the screening engine. The part before @ is case-insensitive; the domain must be exactly test.inlineshield.io.

A held test screening (review@, kyc@, or any held test screening) answers action: "hold" with no reviewId: test mode creates no review. A live key screens these addresses like any other address. Any other address with a test key runs the real screening engine; the answer is real, and nothing is counted.

• Test screenings are recorded. History in the console shows them with "Show test data", marked Test.
• They never count against your monthly quota, and they never create a review, a webhook, a label, learning data or alert data.
• Feedback on a test screening is accepted but never recorded (changed: false).
• Live /verify and /check responses carry the X-Quota-* headers; test responses do not.
• An account that is over its monthly quota gets 402 QUOTA_EXCEEDED on test /verify and /check requests too; nothing is counted.
• A token from a test site key can be redeemed with a live secret key of the same account and the other way round; the result follows the mode of the screening.
• The console's setup checklist does not count test traffic: the "protected" state needs live traffic.

• 300 requests per minute per account on each of /verify and /check, separate from your live limits (/check is also limited to 30 per minute per client IP).
• 300 per minute per test key on /siteverify.
• 10,000 test screenings (/verify and /check) per account per UTC day. Past that, 429 TEST_LIMIT with Retry-After set to the next UTC midnight.

No webhook is sent for test traffic. To check your endpoint, use Settings › Webhook › Send test ping in the console: it sends one signed test.ping delivery. To try a held sign-up end to end with a real reviewId, see Hold and review.