---
title: Sandbox
---

# Sandbox

Test the OIDC flow against a live staging issuer with throwaway clients and accounts. No production data is touched.

## Sandbox issuer

| | URL |
|---|---|
| **Issuer** | `https://id-sandbox.littlexlittle.org` |
| **Discovery** | [`/.well-known/openid-configuration`](https://id-sandbox.littlexlittle.org/.well-known/openid-configuration) |
| **Developer portal** | [app-sandbox.littlexlittle.org/developers](https://app-sandbox.littlexlittle.org/developers) |

The sandbox **resets weekly** at 00:00 UTC every Monday. Treat all tokens, clients, and accounts as ephemeral.

## Test accounts

Pre-seeded accounts you can sign in as:

| Account | Password | Permissions |
|---|---|---|
| `sandbox-admin` | `Sandbox-Admin-2026!` | `lxl.master` on `sandbox-ngo`. |
| `sandbox-editor` | `Sandbox-Edit-2026!` | `Website:Media`, `Donations:View`. |
| `sandbox-viewer` | `Sandbox-View-2026!` | `Donations:View` only. |

## Pre-registered test clients

| Client ID | Type | Redirect URIs |
|---|---|---|
| `sandbox-spa-public` | Public (PKCE) | `http://localhost:8080/cb`, `http://127.0.0.1:8765/cb` |
| `sandbox-server-conf` | Confidential | `http://localhost:8080/cb` |

Secret for `sandbox-server-conf` is shown in the developer portal sandbox tab; rotates weekly.

## Try-it console

The MkDocs build embeds an interactive console at the bottom of every reference page once Algolia search is enabled. For now, use:

- **Postman:** [`Little-X-Little-OIDC.postman_collection.json`](https://github.com/littlexlittle/id-postman/releases/latest/download/Little-X-Little-OIDC.postman_collection.json)
- **Insomnia:** [`Little-X-Little-OIDC.insomnia.json`](https://github.com/littlexlittle/id-postman/releases/latest/download/Little-X-Little-OIDC.insomnia.json)
- **curl** examples on each [reference](reference/endpoints.md) page.

## Reporting bugs

If you find a bug in the sandbox, open an issue at [github.com/littlexlittle/developers-docs](https://github.com/littlexlittle/developers-docs/issues) with:

1. The client_id used.
2. Approximate UTC timestamp.
3. Full request and response (redact secrets).