Sandbox mode

Sandbox Knowledge-Based Authentication (KBA) lets you test the KBA flow in a non-production environment. Any document sent using sandbox OAuth credentials or a sandbox API key is treated as a sandbox document for KBA. Sandbox KBA requests do not incur live KBA costs, so you can safely validate your integration before moving to production.

In sandbox mode, the signer still goes through the KBA flow. To successfully complete KBA during testing, provide the predefined sandbox identity details listed below.

Use the John Smith identity details on this page only for sandbox KBA testing. Do not use real personal or identity information.

Use the following values exactly as shown when completing KBA in sandbox mode.

FieldSandbox value
First nameJOHN
Last nameSMITH
Address222333 PEACHTREE PLACE
CityATLANTA
StateGEORGIA (GA)
ZIP30318
SSN last four3333

If these values are entered as expected in sandbox mode, the signer can successfully complete the KBA test flow.

A sandbox KBA attempt may show only a subset of the questions below.

Select the answer shown in the table when the corresponding question appears. For questions identified below as fictional, select None of the above.

QuestionCorrect sandbox answer
Address number for the most recent address3612
Address number for an older address5555
Address number for a fictional addressNone of the above
Street lived on for the recent-address questionAny
Street lived on for the older-address questionBeach
Street lived on for a fictional addressNone of the above
City for a fictional previous streetNone of the above
City for the oldest previous streetAtlanta
City for a fictional oldest previous streetNone of the above
County for a known city addressFulton
County for a fictional city addressNone of the above
Vehicle model year2005
Known personAnthony Brown
Birth year1975
Residence typeSingle Family Residence
Birth monthFebruary
County lived inFulton
County lived in for a fictional locationNone of the above
Last two SSN digits33
Fictional lived-at addressNone of the above
Person who is not a relative or known associateSelect any displayed name with the last name Smith
Associated name with a fictional last nameNone of the above
First two SSN digits11
First two SSN digits for a fictional identityNone of the above
Related phone number for a fictional identityNone of the above
Person from whom the property was purchasedJoe Anderson
Time associated with propertyOver 5 years
Approximate property square footageOver 2,500
Property purchase timeAugust 1999
Person from whom a fictional property was purchasedNone of the above
Purchase time for a fictional propertyNone of the above
State lived in during the years shownNew York
Vehicle purchase or lease timeDecember 2006
Known person for a fictional identityNone of the above

The wording and order of answer choices may vary. Match the question's meaning to this table rather than relying on its position in the challenge.

Name matching for KBA is used to compare the signer's name in the document request with the predefined sandbox identity used during testing. This helps simulate how name-based verification behaves before moving your integration to production.

If you set NameMatcher to a value other than None, such as Lenient, Moderate, or Strict, set the signer's name to John Smith. The sandbox KBA flow expects the signer name to match the predefined sandbox identity.

To avoid validation issues during sandbox testing, make sure both the signer name and the KBA answers align with the sandbox data. If name matching is enabled and the signer name does not match John Smith, the sandbox KBA flow may not validate successfully.

We recommend always enabling NameMatcher, at a minimum of Lenient.

The following examples send a document with KBA enabled for one signer in sandbox mode.

curl -X 'POST' \
  'https://api.boldsign.com/v1/document/send' \
  -H 'accept: application/json' \
  -H 'X-API-KEY: {Your sandbox API key}' \
  -H 'Content-Type: multipart/form-data' \
  -F 'Files=@{Your file path};type=application/pdf' \
  -F 'Title=Agreement' \
  -F 'Message=This document is sent for sandbox KBA testing.' \
  -F 'Signers={
  "name": "John Smith",
  "emailAddress": "[email protected]",
  "authenticationType": "KBA",
  "kbaSettings": {
    "type": "EveryAccess",
    "maximumRetryCount": 3,
    "nameMatcher": "Strict"
  },
  "signerType": "Signer",
  "formFields": [
    {
      "id": "signature1",
      "name": "signature1",
      "fieldType": "Signature",
      "pageNumber": 1,
      "bounds": {
        "x": 100,
        "y": 100,
        "width": 100,
        "height": 50
      },
      "isRequired": true
    }
  ]
}'
using BoldSign.Api;
using BoldSign.Api.Model;
using BoldSign.Api.Model.Kba;
using BoldSign.Model;

var apiClient = new ApiClient("https://api.boldsign.com", "{Your sandbox API key}");
var documentClient = new DocumentClient(apiClient);

var documentFilePath = new DocumentFilePath
{
    ContentType = "application/pdf",
    FilePath = "{Your File Path}",
};

var filesToUpload = new List<IDocumentFile>
{
    documentFilePath,
};

var signatureField = new FormField(
    id: "signature1",
    isRequired: true,
    type: FieldType.Signature,
    pageNumber: 1,
    bounds: new Rectangle(x: 100, y: 100, width: 100, height: 50));

var kbaSettings = new KbaSettings
{
    Type = AuthenticationFrequency.EveryAccess,
    MaximumRetryCount = 3,
    NameMatcher = KbaNameMatchLevel.Strict,
};

var signer = new DocumentSigner(
    signerName: "John Smith",
    signerType: SignerType.Signer,
    signerEmail: "[email protected]",
    authenticationType: AuthenticationType.KBA,
    formFields: new List<FormField> { signatureField },
    locale: Locales.EN)
{
    KbaSettings = kbaSettings,
};

var sendForSign = new SendForSign
{
    Title = "Agreement",
    Message = "This document is sent for sandbox KBA testing.",
    Signers = new List<DocumentSigner> { signer },
    Files = filesToUpload,
};

var documentCreated = documentClient.SendDocument(sendForSign);
Console.WriteLine(documentCreated.DocumentId);
import boldsign

configuration = boldsign.Configuration(host="https://api.boldsign.com", api_key="YOUR_SANDBOX_API_KEY")

with boldsign.ApiClient(configuration) as api_client:

    document_api = boldsign.DocumentApi(api_client)

    send_for_sign = boldsign.SendForSign(
        title="Agreement",
        message="This document is sent for sandbox KBA testing.",
        files=["YOUR_FILE_PATH"],
        signers=[
            boldsign.DocumentSigner(
                name="Alex Gayle",
                emailAddress="[email protected]",
                signerType="Signer",
                authenticationType="KBA",
                kbaSettings=boldsign.KbaSettings(
                    type="EveryAccess",
                    maximumRetryCount=3,
                    nameMatcher="Strict"
                ),
                formFields=[
                    boldsign.FormField(
                        name="signature1",
                        fieldType="Signature",
                        pageNumber=1,
                        isRequired=True,
                        bounds=boldsign.Rectangle(x=100, y=100, width=100, height=50)
                    )
                ],
                locale="EN"
            )
        ]
    )

    document_created = document_api.send_document(send_for_sign)
    print(document_created.document_id)
<?php require_once "vendor/autoload.php";

use BoldSign\Configuration;
use BoldSign\Api\DocumentApi;
use BoldSign\Model\FormField;
use BoldSign\Model\Rectangle;
use BoldSign\Model\DocumentSigner;
use BoldSign\Model\KbaSettings;
use BoldSign\Model\SendForSign;

$config = new Configuration();
$config->setHost('https://api.boldsign.com');
$config->setApiKey('YOUR_SANDBOX_API_KEY');

$document_api = new DocumentApi($config);

$form_field = new FormField();
$form_field->setName('signature1');
$form_field->setFieldType('Signature');
$form_field->setPageNumber(1);
$form_field->setIsRequired(true);
$bounds = new Rectangle([100, 100, 100, 50]);
$form_field->setBounds($bounds);

$kba_settings = new KbaSettings();
$kba_settings->setType('EveryAccess');
$kba_settings->setMaximumRetryCount(3);
$kba_settings->setNameMatcher('Strict');

$document_signer = new DocumentSigner();
$document_signer->setName('Alex Gayle');
$document_signer->setEmailAddress('[email protected]');
$document_signer->setSignerType('Signer');
$document_signer->setAuthenticationType('KBA');
$document_signer->setLocale('EN');
$document_signer->setFormFields([$form_field]);
$document_signer->setKbaSettings($kba_settings);

$send_for_sign = new SendForSign();
$send_for_sign->setTitle('Agreement');
$send_for_sign->setMessage('This document is sent for sandbox KBA testing.');
$send_for_sign->setFiles(['YOUR_FILE_PATH']);
$send_for_sign->setSigners([$document_signer]);

$document_created = $document_api->sendDocument($send_for_sign);
import java.io.File;
import java.util.Arrays;

import com.boldsign.ApiClient;
import com.boldsign.Configuration;
import com.boldsign.api.DocumentApi;
import com.boldsign.model.DocumentCreated;
import com.boldsign.model.DocumentSigner;
import com.boldsign.model.FormField;
import com.boldsign.model.KbaSettings;
import com.boldsign.model.Rectangle;
import com.boldsign.model.SendForSign;

ApiClient client = Configuration.getDefaultApiClient();
client.setBasePath("https://api.boldsign.com");
client.setApiKey("YOUR_SANDBOX_API_KEY");

DocumentApi documentApi = new DocumentApi(client);

FormField formField = new FormField();
formField.setName("signature1");
formField.setFieldType(FormField.FieldTypeEnum.SIGNATURE);
formField.setPageNumber(1);
formField.setIsRequired(true);
Rectangle bounds = new Rectangle().x(100f).y(100f).width(100f).height(50f);
formField.setBounds(bounds);

KbaSettings kbaSettings = new KbaSettings();
kbaSettings.setType(KbaSettings.TypeEnum.EVERY_ACCESS);
kbaSettings.setMaximumRetryCount(3);
kbaSettings.setNameMatcher(KbaSettings.NameMatcherEnum.STRICT);

DocumentSigner signer = new DocumentSigner();
signer.setName("Alex Gayle");
signer.setEmailAddress("[email protected]");
signer.setSignerType(DocumentSigner.SignerTypeEnum.SIGNER);
signer.setAuthenticationType(DocumentSigner.AuthenticationTypeEnum.KBA);
signer.setLocale(DocumentSigner.LocaleEnum.EN);
signer.setFormFields(Arrays.asList(formField));
signer.setKbaSettings(kbaSettings);

SendForSign sendForSign = new SendForSign();
File file = new File("YOUR_FILE_PATH");
sendForSign.setFiles(Arrays.asList(file));
sendForSign.setSigners(Arrays.asList(signer));
sendForSign.setTitle("Agreement");
sendForSign.setMessage("This document is sent for sandbox KBA testing.");

DocumentCreated documentCreated = documentApi.sendDocument(sendForSign);
import { DocumentApi, DocumentSigner, FormField, Rectangle, SendForSign, KbaSettings } from "boldsign";
import * as fs from 'fs';

const baseUrl = "https://api.boldsign.com";
const documentApi = new DocumentApi(baseUrl);
documentApi.setApiKey("YOUR_SANDBOX_API_KEY");

const bounds = new Rectangle();
bounds.x = 100;
bounds.y = 100;
bounds.width = 100;
bounds.height = 50;

const formField = new FormField();
formField.name = "signature1";
formField.fieldType = FormField.FieldTypeEnum.Signature;
formField.pageNumber = 1;
formField.isRequired = true;
formField.bounds = bounds;

const kbaSettings = new KbaSettings();
kbaSettings.type = KbaSettings.TypeEnum.EveryAccess;
kbaSettings.maximumRetryCount = 3;
kbaSettings.nameMatcher = KbaSettings.NameMatcherEnum.Strict;

const documentSigner = new DocumentSigner();
documentSigner.name = "Alex Gayle";
documentSigner.emailAddress = "[email protected]";
documentSigner.signerType = DocumentSigner.SignerTypeEnum.Signer;
documentSigner.authenticationType = DocumentSigner.AuthenticationTypeEnum.Kba;
documentSigner.locale = DocumentSigner.LocaleEnum.En;
documentSigner.formFields = [formField];
documentSigner.kbaSettings = kbaSettings;

const files = fs.createReadStream("YOUR_FILE_PATH");

const sendForSign = new SendForSign();
sendForSign.title = "Agreement";
sendForSign.message = "This document is sent for sandbox KBA testing.";
sendForSign.signers = [documentSigner];
sendForSign.files = [files];

const documentCreated = await documentApi.sendDocument(sendForSign);

Replace {Your sandbox API key}, {Your file path}, and the signer email with your sandbox values. Keep the signer name as John Smith when nameMatcher is enabled.

  • Documents sent with sandbox OAuth credentials are treated as sandbox documents for KBA.
  • Documents sent with a sandbox API key are also treated as sandbox documents for KBA.
  • Sandbox KBA is intended only for testing and validation.
  • Sandbox KBA usage does not incur live KBA charges.