The sandbox is a complete Human Pass with test people instead of real ones. Build and test your integration there, then create a production client when you're ready.
Sandbox and production
| Sandbox | Production | |
|---|---|---|
| Issuer | https://id.sandbox.humanpass.co | https://id.humanpass.co |
| Dashboard | dashboard.sandbox.humanpass.co | dashboard.humanpass.co |
| Who signs in | Test personas you pick from a list | Real people with real IDs |
| Redirect URIs | https anywhere, or http://localhost | https, on a domain you've verified |
| IDs | Never the same as in production | Never the same as in the sandbox |
| Rotation drill | Yes | No |
| Cost | Free | Pricing |
Test personas
In the sandbox, the ID check is replaced by a page where you choose a test persona. Each one plays out a case you should handle. Real documents and faces are never involved.
| Persona | What happens |
|---|---|
alice | A US passport: a new person. Sign in again to see the same sub. |
alice-2nd-account | The same passport through a different provider account: recognised as Alice, same sub. |
alice-renewed | Alice's renewed passport, with a new number: still Alice. |
bob | A California driver's licence: a different person, a different sub. |
bob-variant | Bob's licence number typed differently (d123-4567): still Bob. |
frank | Another California licence: another person. |
young | Aged 20: an adult, so a Human Pass, but age_over_21 is false. |
teen | Aged 15: refused (adults only). Your site gets access_denied. |
lapsed | An expired licence: refused. |
carol | Verified without a document: refused. |
erin | A US passport and no licence: allowed through the "I don't have a licence or ID card" option. |
The persona page lists more, for less common cases (name changes, documents from two states, a German ID card).
Cases to try
- The same person twice: sign in as
alice, sign out of your site, create a second Human Pass with another email and choosealice-2nd-account. Human Pass recognises her: instead of a second Human Pass, she's offered her existing one back (the new sign-in joins it after a safety wait). Either way your site never sees a secondsub, so she can't make a second account. - Cancelling: press "Cancel" on the persona page. Your callback gets
error=access_denied. - Refusals:
teen,lapsedandcarol. Your site only ever seesaccess_denied, never the reason. - Two projects: create a second project with its own client and sign in as Alice to both: the IDs differ.
Rotation drill
Human Pass may one day rotate the key behind IDs (for example after a security incident). In the sandbox you can rehearse it: on a client's page in the dashboard, rotate one test person's ID, then sign them in again and run your status check. Your site should end up with the same account under the new ID. See rotations.