Skip to content
PPAI-ETMSDeveloper Portal

Sandbox onboarding

The staging environment doubles as the insurer sandbox: a fully isolated deployment (separate database, separate credentials) for integration testing before you go live in production. There is no insurer web portal at any point in this process — sandbox access means a second, separate set of machine API credentials, requested from and issued by LTFRB the same way as production ones.

What the sandbox is for

  • Building and testing your signing implementation against the test vector in the integration guide.
  • End-to-end testing of transmit, amend and cancel calls without touching production data.
  • Verifying your error handling against every code in status codes & errors, including VEHICLE_ALREADY_INSURED.
  • Load-testing at low volume before requesting a production rate limit increase.

Requesting sandbox credentials

  1. Contact LTFRB to request that your organization be provisioned in staging as one of the participating insurers.
  2. An LTFRB administrator creates your organization in the sandbox environment and creates a sandbox API client for it (scopes, IP allowlist, rate limit) from the admin portal.
  3. LTFRB delivers the sandbox client_id, client_secret and signing_secret to you through a secure out-of-band channel — the same one-time delivery model as production (see the integration guide's Obtain credentials section).
  4. Store the three values in your own secrets manager immediately; they are shown once and can only be rotated afterward, not re-retrieved.
http
POST /api/v1/oauth/token HTTP/1.1
Host: sandbox-api.example.gov.ph
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=<SANDBOX_CLIENT_ID>&client_secret=<SANDBOX_CLIENT_SECRET>

Sandbox is a separate environment, not a mode flag

Sandbox and production are fully separate deployments with separate databases and credentials — a sandbox token will never authenticate against the production API, and vice versa. Since there is no insurer-facing UI to show a "SANDBOX" watermark, treat the hostname and credential set themselves as the source of truth for which environment you are talking to; LTFRB Admin's own screens are watermarked for staff working in the sandbox environment. Do not submit real operator or vehicle personal data to the sandbox — use fictional test data only.

Test credentials process

Sandbox client_id/client_secret pairs follow the same lifecycle as production: secrets are shown once, rotation keeps the old secret valid for 7 days, and secrets expire after 365 days. Sandbox and production credentials are entirely separate — a sandbox token will not authenticate against the production API, and vice versa.

Data reset policy

Sandbox data is periodically reset by LTFRB to keep the environment representative and free of accumulated test debris. Do not treat sandbox records as durable — re-run your test suite after a reset rather than relying on previously created references. LTFRB will announce reset windows in advance to onboarded integrators.

Moving to production

Once your integration passes your own test plan against the sandbox, request production credentials through the same LTFRB relationship channel. Production and sandbox use different hostnames and credentials — double-check NEXT_PUBLIC_API_BASE_URL style configuration in your deployment before switching.