The sandbox's check desk

Send exactly the headers and body you would send to the order door. All four checks run and each is reported — headers present, provider key, clock skew, nonce shape, whether the HMAC verified under the secret in service or the previous one — with the sha256 of the signing string we computed so you can compare bytes. No nonce is consumed, nothing is delivered, no money moves. On the sandbox account the expected signature is printed, since that secret is public. THIS PATH IS THE SANDBOX: the account named sandbox, whose signing secret and provider key are published on /trade and returned by a GET on its check desk. Real signatures checked, real goods delivered and marked test, nothing booked to anyone, fifty a day.