---
title: "Request a sandbox (test) key by email — the endpoint behind the form at worthune.com/sandbox"
method: POST
path: "/api/v1/sandbox"
tags: ["keys"]
---

# Request a sandbox (test) key by email — the endpoint behind the form at worthune.com/sandbox

`POST /api/v1/sandbox`

## Request

- Base URL: `https://worthune.com`
- URL: `https://worthune.com/api/v1/sandbox`
- Auth: none required

Emails a wk_ key on the sandbox plan: the whole model catalog (2000 runs a day) and up to 5 stored households at a time (25 in all) over REST, MCP and the SDKs for 30 days, 300 stored-household calls an hour, Monte Carlo up to 1000 paths, 2 webhook endpoints, no white-label surfaces, narration and mapping drafts only on the caller's own model (a narrator or extractor model assigned at /api/v1/model-policy, or x-model-key over REST). The key is delivered by email, never in the response. One sandbox organization per inbox (aliases fold): a fresh key can be requested from the first day of the current key's last 7 days, 3 keys in all, and the current key keeps working until it expires. This is the form's endpoint: it needs the reCAPTCHA token the browser form obtains, so a bare JSON call answers 403 — a person requests the key once at worthune.com/sandbox, then any client uses it. Every well-formed, in-limit request answers the same 202 whether a key was issued or not: an inbox that already holds a plan, has used its keys, or is not yet in its renewal window is told why by email, never in the response, so the endpoint does not reveal who is a customer. Rate-limited per address (5 an hour), per inbox (1 a day, aliases folded), per company domain (10 a day; shared public mailboxes exempt) and site-wide (200 a day); the inbox, domain and site-wide counters are spent only when an email actually went out.

## Request body

- object
  - `email` string, email, required
  - `recaptchaToken` string: The reCAPTCHA v3 token the form obtains in the browser (action "sandbox"). Required wherever the bot check is configured, which is every public deployment.

## Response `202`

Accepted: if the inbox can have a sandbox, the key is in it within minutes; if not, the email says why.

- object
  - `ok` unknown, required
  - `delivery` string, required: "email". Under the local integration harness only: "response (local harness only)", with `key`, `renewed` and `expiresAt`.
  - `email` string, required
  - `note` string, required
  - `key` string: Local integration harness only — never on a public deployment.
  - `renewed` boolean: Local integration harness only: an earlier sandbox key for this inbox exists and keeps working until its own expiry.
  - `expiresAt` string, date-time: Local integration harness only.
  - `limits` object, required
    - `activeHouseholds` integer, required
    - `lifetimeHouseholds` integer, required
    - `days` integer, required
    - `lifetimeKeys` integer, required
    - `hourlyStatefulRequests` integer, required
    - `modelRunsPerDay` integer, required
    - `monteCarloSimulations` integer, required
    - `webhookEndpoints` integer, required
    - `notIncluded` string[], required
  - `next` string, required

## Other responses

- `400`: Malformed JSON, a body of the wrong shape, or a top-level field that fails its check.
- `403`: The bot check did not pass: the request carried no valid reCAPTCHA token. Request the key from the form at worthune.com/sandbox in a browser.
- `429`: Hourly per-org stateful quota, a per-route durable limit, or the 120 requests/minute per-IP burst backstop.
- `503`: The key could not be emailed; nothing was issued and nothing was spent — try again in a few minutes.

---

[API](https://skmtc.dev/worthune/apis/worthune-api.md) · [All operations](https://skmtc.dev/worthune/apis/worthune-api/llms.txt) · [OpenAPI document](https://skmtc.dev/worthune/apis/worthune-api/revisions/9f2241072555?raw)