Sandbox and test data

The sandbox is a full copy of the API running against its own database. Same code, same rules, same error codes — different data, and nothing that reaches a real customer.

Base URLs

base urls

live     https://api.turanyol.com
sandbox  http://localhost:3050

Keys are bound to one environment

A key created as Sandbox works only against the sandbox base URL; a live key only against the live one. Sending the wrong one is refused with ERR_API_KEY_ENVIRONMENT, which is deliberately distinct from an invalid key so you can tell a configuration mistake from a credential problem.

ERR_API_KEY_ENVIRONMENT

Test phone numbers

Sign-in uses phone OTP. In the sandbox the provider is mocked: the code is returned in the response and displayed on the sign-in screen, so no SMS is ever sent.

Test accounts
Role	Phone	Notes
Partner	`+994500000040`	Kargo Express — orders:read, orders:pii, logistics:write
Partner	`+994500000041`	PayAZ — payments:read
Customer	`+994500000100`	Aysel Məmmədova — ES-1049, ES-1025, ES-1001
Seller	`+994500000010`	Vendor A-101
Driver	`+994500000020`	B-2083 completed, B-2084 assigned
Runner	`+994500000030`	Hub pickup queue
Support agent	`+994500000002`	Günel Rəhimova
Administrator	`+994500000001`	Kamil Hüseynov

Seeded data

The sandbox is rebuilt from a deterministic seed with realistic Baku data — Sadarak stalls, categories in az/ru/en, customers in 20 Yanvar, Gənclik, Yasamal, Nərimanov and Nizami, orders in every status, drivers and batches.

The mock card payment flow

Card payments in the sandbox run through the mock provider, so you can exercise the whole flow without a PSP:

Place an order with paymentMethod CARD. The order comes back UNPAID with a payment intent and a checkoutUrl.
Open the checkout URL. The mock provider serves a small page with Pay and Fail buttons.
Choosing an outcome makes the provider send a signed webhook to the API — the same webhook path a real PSP would use.
The order becomes PAID or the intent FAILED, and the customer sees the change over the realtime channel.

Unpaid card orders auto-cancel after the configured payment timeout, so a half-finished test does not leave stock reserved forever.

Resetting the sandbox

The sandbox database is disposable. Ask us to reset it, or if you run the stack yourself:

shell

# 1. stop the sandbox API
pnpm --filter @turanyol/api exec -- true   # (stop the 'dev:api:sandbox' process)

# 2. re-apply migrations and re-seed the sandbox database
DATABASE_URL=postgresql://esadarak:esadarak@localhost:5433/esadarak_sandbox?schema=public \
  pnpm --filter @turanyol/api prisma:deploy
DATABASE_URL=postgresql://esadarak:esadarak@localhost:5433/esadarak_sandbox?schema=public \
  pnpm db:seed

# 3. start it again
pnpm dev:api:sandbox

Resetting invalidates nothing on the live API: keys, webhooks and orders there are untouched.

What is not different

Scopes, rate limits, the order state machine and the webhook signature scheme behave exactly as they do in production. If it works in the sandbox, it works live — that is the point.

Sandbox status