Build in sandbox, then request production
import { g8 } from "@graph8/sdk" await g8.sandbox.seed("northwind")const c = await g8.contacts.search()c.length // 1,284, all test dataSeeded org, test data
Sandbox ready
test keys, never billed
reset or snapshot anytime
Same API. One is safe to break.
Sandbox and production review share one API surface and one SDK. The key prefix decides which world you touch. Sandbox is isolated, free, and never sends or charges for real.
| Dimension | Sandbox | Production review |
|---|---|---|
| Key prefix | g8_sk_test_… | g8_sk_review_… |
| Data | seeded sample org | your approved workspace |
| Email + dialer | simulated, never delivered | approved sends |
| Billing | test charges, never real | contracted billing |
| Isolation | fully separate from production review | system of record |
| Cost | free | approved plan terms |
| Access | available in preview | approved production workspace |
All six surfaces, callable on day one.
Preview access starts with the full sandbox surface against a seeded sample org, so you can build the real integration before production access is approved.
Data
test data/v1/contacts
Contacts, companies, and deals over a seeded sample org. Read and write against test data.
Signals
test data/v1/signals
Buyer intent, web visitors, and enrichment events, simulated against the sample org.
Studio
test data/v1/studio/campaigns
Generate campaigns, briefs, and creative. Outputs are real, sends stay simulated.
Revenue
test data/v1/revenue/accounts
Accounts, pipeline, and metered usage with test charges that never hit a card.
Engage
test data/v1/engage/sequences
Sequences, email, and dialer. Every send is captured and simulated, never delivered.
Agents
test data/v1/agents/runs
The agent runtime with full tool access, running against your sandbox slice.
Access exactly what you need.
Every key carries scopes per surface. Grant a key read on Data and write on Engage, and nothing else. The same scope model applies to test and live keys, so what you tested is what you ship.
Scopes are enforced server-side on every request. A key that lacks a scope gets a clean 403, never partial data.
| Surface | Read scope | Write scope |
|---|---|---|
| Data | data:read | data:write |
| Signals | signals:read | signals:write |
| Studio | studio:read | studio:write |
| Revenue | revenue:read | revenue:write |
| Engage | engage:read | engage:write |
| Agents | agents:read | agents:run |
Reset to a known state, every time.
Sandbox is yours to break. Seed a full sample org, mutate it in a test, then reset or restore a snapshot so the next run starts clean. Drive it from the CLI or the console.
Seed sample data
Load a full sample org: 1,284 contacts, 412 companies, 37 deals, ready to query.
g8 sandbox seed --preset northwind Reset to clean
Wipe every object in sandbox and start from an empty workspace in seconds.
g8 sandbox reset Snapshot + restore
Freeze a known state, run a test that mutates it, then restore the snapshot.
g8 sandbox snapshot save demo Sandbox ready
g8_sk_test_4eC39HqLyjWDarjtT1zdp7dc curl $GRAPH8_API_BASE/v1/contacts?title=VP+Sales \ -H "Authorization: Bearer g8_sk_test_4eC39HqLyjWDarjtT1zdp7dc" \ -H "X-Org-Id: ws_sandbox_8h2k"Seeded data
- Sample org
- Northwind Labs
- Contacts
- 1,284
- Companies
- 412
- Deals
- 37
- Surfaces enabled
- all six
- Region
- us-east
From sandbox to approved workspace, four steps.
When the integration works in sandbox, production access is a controlled promotion. Approve terms, issue live keys with the scopes you already tested, and point the same code at the approved workspace.
Verify your workspace
Confirm your email, org, and intended production workspace. Sandbox stays available alongside it.
Approve terms
Set billing, support, and data terms for the workspace. Public list pricing does not apply here.
Issue review keys
Generate review keys with the exact scopes you tested against. Test keys keep working in sandbox.
Swap the key
Point the same code at your approved workspace key. Real sends and billing only turn on after approval.
Production checklist
before you flip- ✓ Email domain authenticated (SPF, DKIM, DMARC)
- ✓ Webhook endpoints verified and signed
- ✓ Rate limits reviewed for your plan
- ✓ Production key scopes match your sandbox tests
- ✓ Billing method on file