Sandbox¶
Test the OIDC flow against a live staging issuer with throwaway clients and accounts. No production data is touched.
Sandbox issuer¶
| URL | |
|---|---|
| Issuer | https://id-sandbox.littlexlittle.org |
| Discovery | /.well-known/openid-configuration |
| Developer portal | app-sandbox.littlexlittle.org/developers |
The sandbox resets weekly at 00:00 UTC every Monday. Treat all tokens, clients, and accounts as ephemeral.
Test accounts¶
Pre-seeded accounts you can sign in as:
| Account | Password | Permissions |
|---|---|---|
sandbox-admin | Sandbox-Admin-2026! | lxl.master on sandbox-ngo. |
sandbox-editor | Sandbox-Edit-2026! | Website:Media, Donations:View. |
sandbox-viewer | Sandbox-View-2026! | Donations:View only. |
Pre-registered test clients¶
| Client ID | Type | Redirect URIs |
|---|---|---|
sandbox-spa-public | Public (PKCE) | http://localhost:8080/cb, http://127.0.0.1:8765/cb |
sandbox-server-conf | Confidential | http://localhost:8080/cb |
Secret for sandbox-server-conf is shown in the developer portal sandbox tab; rotates weekly.
Try-it console¶
The MkDocs build embeds an interactive console at the bottom of every reference page once Algolia search is enabled. For now, use:
- Postman:
Little-X-Little-OIDC.postman_collection.json - Insomnia:
Little-X-Little-OIDC.insomnia.json - curl examples on each reference page.
Reporting bugs¶
If you find a bug in the sandbox, open an issue at github.com/littlexlittle/developers-docs with:
- The client_id used.
- Approximate UTC timestamp.
- Full request and response (redact secrets).