Sandbox & developer accounts

Why use it

• No Pro plan needed for app tokens or app webhooks.
• Realistic sample orders, products, stock, contacts, and chat from the first minute; no marketplace store to connect.
• Simulated webhook events let you test your receiver without waiting for real orders.
• Test your own OAuth app end to end before submitting it for review.

Create a developer account

Sign up with the developer account type. It is free.

In a developer workspace, API access always goes through an OAuth app: register an app under Developer Console → Aplikasi, then press Buat token uji to get an access token.

Sample data

Every developer account is seeded with:

What is blocked

A developer account cannot create or connect real stores, connect chat, change plan, pay invoices, or buy AI credits. These operations answer 403 DEVELOPER_ACCOUNT_RESTRICTED. API keys and manual webhook endpoints are not available either: API access and webhooks always go through OAuth apps.

Sandbox mode

A request runs in sandbox mode when it uses:

• any app token installed in a developer workspace, or
• a token of an app that is not yet published, installed in its own developer’s tenant. This works on any plan, including a free merchant account.

• x-ratelimit-limit shows the limit that applies (60 or 600).
• GET /v1/developer/token-info returns sandbox: true.

{
  "tenantId": "0192f0c0-1111-7aaa-8bbb-0123456789ab",
  "kind": "api_key",
  "scopes": [
    "orders:read"
  ],
  "sandbox": true
}

Test your OAuth app before review

1. Register the app under Developer Console → Aplikasi. It starts in development.
2. Press Buat token uji to install the app in this workspace and get an access and refresh token right away (POST /v1/developer/apps/{appId}/test-token). To test the full flow, run the authorization flow while signed in to the same workspace.
3. The tokens you get run in sandbox mode: no Pro needed, 60 requests/minute.
4. When it works, press Ajukan review.

Simulated events

POST /v1/developer/sandbox/events queues a sample event of the given type (any webhook event) to every endpoint of the tenant subscribed to that type, app-managed endpoints included. In the console it is the Kirim simulasi button under Developer Console → Simulasi event. Events reach the webhooks of apps installed in this workspace.

curl -X POST "https://api.comnethub.app/v1/developer/sandbox/events" \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type": "inventory.stock_changed"}'

{
  "eventId": "0192f0d0-aaaa-7bbb-8ccc-ddddeeeeffff",
  "deliveries": 2
}

deliveries is the number of endpoints the event was queued for. The envelope is the normal one plus simulated: true, signed with the same headers:

{
  "id": "0192f0d0-aaaa-7bbb-8ccc-ddddeeeeffff",
  "type": "inventory.stock_changed",
  "createdAt": "2026-11-04T07:12:31.204Z",
  "tenantId": "0192f0c0-1111-7aaa-8bbb-0123456789ab",
  "simulated": true,
  "data": {
    "itemId": "0192f0c8-5d6e-7f80-91a2-b3c4d5e6f708",
    "sku": "KAOS-M",
    "name": "Kaos Polos Katun M",
    "previousAvailable": 6,
    "available": 4,
    "reason": "order"
  }
}

Moving to production

• API keys for your own business: create them on a merchant tenant with the Pro plan; they then get 600 requests/minute.
• Apps: once the app is published, installs follow the normal rules. The installing merchant needs Pro, and the limit is 600 requests/minute per installation. Its own-tenant installation leaves sandbox mode too, unless that tenant is a developer account.
• Drop handling that depends on sample data, and keep ignoring simulated: true events.