Projects & Sandbox

A sandbox project is a fully isolated test environment: payments run through Stripe's test mode so no real money moves, you can assign fixed one-time codes to test contacts so nothing is actually emailed or texted, users can be hard-deleted, contact methods can be marked verified directly, and request/response body logging is on by default. A live project flips each of those — real money, real codes, suspend-only, body logging off.

You choose sandbox at project creation and it can never be changed, so create separate projects per environment.

A project is an isolated grouping of your users, services, websites, and content. Resources inside a project are shared — any user can call any service in it — and nothing crosses project boundaries. Projects are free, with no limit on how many you create.

Create a separate project per environment — projects are free and fully isolated, so a staging project can't touch production users or data. A common setup is a sandbox project for automated tests, a staging project for pre-release verification, and a live project for production traffic.

Use the client-side API (forte.users.*) from browsers and mobile apps — it authenticates with the signed-in user's session cookie and is scoped to that one user. Use the server-side API (forte.projects.*) from your backend — it authenticates with FORTE_API_TOKEN and acts as the project owner: admin user management, payments on behalf of any user, logs and metrics.

Rule of thumb: if the credential lives in a browser, it's client-side; if it lives in a server environment variable, it's server-side.

It's the Bearer token for Forte's server-side API, scoped to one project. Every deployed service receives it automatically as an environment variable, and the SDKs pick it up with no configuration.

It's a server-only secret: never expose it to a browser or commit it to your repository.

No. Sandbox mode is chosen when the project is created and is permanent in both directions — a sandbox project can't become live, and a live project can't become a sandbox. Create a separate project for each environment you need; projects are free and unlimited.

Fixed one-time codes can be assigned to designated test contacts only: US phone numbers with a 555 exchange (like +1 202 555 0142), and emails on example.com, example.net, example.org, or any domain ending in .test, .example, or .invalid.

Once set, every code sent to that contact uses your fixed value and nothing is actually delivered — while expiry, resend throttling, and attempt limits behave exactly as in production.

Don't. Sandbox projects trade safeguards for testability — hard-delete and direct contact-method overrides are enabled — so they're not appropriate for real customer PII, production traffic, real billing, or compliance data. Keep real users on a live project and use sandbox for tests, QA, and demos.