Sandbox and production

Every credential belongs to one environment: SANDBOX or PRODUCTION. The token response tells you which.

What each environment allows

Environment	Allowed	Not allowed
SANDBOX	All reads, webhooks, recall drills, and events for the demo product (GTIN 00000000000017), against your own demo data.	Events for real products, packing and unpacking SSCCs, writing the product catalogue, confirming shipments, opening real recalls and authorizing contract packers.
PRODUCTION	Everything your scopes and partner type allow, against real data.	Nothing beyond your scopes.

Endpoints marked Production credentials only in the API reference return 403 to a sandbox credential.

Getting a sandbox credential

Sandbox signup is instant and needs no licence number. The secret is shown once on screen, and a copy is emailed to you.

• A manufacturer sandbox gets its own demo supplier account, with a delivery of batch SANDBOX-BATCH-001 to DawaTrack Sandbox Pharmacy.
• A distributor or pharmacy sandbox is linked to DawaTrack Sandbox Pharmacy, so it can practise reading and acknowledging recalls.

Going to production

Apply for production access with your organisation's details, partner type, and your PPB licence number (manufacturers) or business registration number (distributors and pharmacies).

There is no public registry API to check these numbers against, so a person on our team reviews each application. When it's approved, your production client_id and client_secret are emailed to you. That email is the only time the secret is shown: it's stored hashed and can't be recovered. If it's lost, ask us for a new credential.

A distributor or pharmacy credential also needs a link to the facility it acts for before its recall endpoints return anything. Tell us which facility when you apply. To receive order and return webhooks, ask us to link your credential to your supplier account.

Your sandbox credentials keep working after you go live.