Sandbox credentials that do not burn Live debit

Sandbox credentials exist so engineering can send test traffic without touching the prepaid ledger. Live debit must stay impossible from a sandbox key — not a soft warning in a README that nobody reads during an incident.

IOSOR treats sandbox as a separate credit posture: test OTP and alert paths may succeed in the sandbox lane while the wallet stays flat. If a hold or debit appears from a key labeled sandbox, that credential is mis-scoped and must be revoked before the next CI run.

Separate sandbox keys from Live holds

Create a sandbox key in Developers that cannot open a prepaid hold. Prove a test OTP send returns success in the sandbox lane with zero wallet debit and zero MRC charge on the same minute. Export the ledger for that window and keep the proof next to the key id.

If a hold row appears, revoke that key immediately and treat it as a credential defect — not a flaky test. Re-issue a correctly scoped sandbox key and repeat the proof until the ledger stays flat.

Bind CI and staging only to sandbox scopes

Point continuous integration and staging environment variables at sandbox credentials only. Never paste a Live key into a GitHub secret, Docker compose file, laptop .env used for demos, or a shared password manager folder labeled “test”.

Rotate any Live key that ever appeared in a test harness. Record the rotate time so finance can match any stray debit to the leak window. Staging hosts that still hold a Live secret after rotate fail the next deploy gate.

Prove debit isolation before the first pilot

Export the ledger for the sandbox send window before you invite a pilot host. Confirm no hold, no debit, and no quiet-hours Live path fired from the sandbox key. Document the proof next to the key id so finance can audit that test traffic did not spend.

Repeat the export after the first week of CI so drift does not silently reintroduce a Live key through a forgotten workflow variable.

Cutover habits stay under Developers

When you promote a build, follow the Live cutover checklist under Developers — mint a new Live key, revoke sandbox from production hosts, and smoke vault freshness before runway green. Do not reuse the sandbox secret as a temporary Live key “just for the pilot”.

Cutover is a credential change plus a ledger check, not a config flag flip. Keep webhook targets and key ids aligned with the environment you claim on the runway board.

Related ops paths

Keep cutover and coverage honesty adjacent so teams do not invent a third key story:

• Sandbox vs production keys cutover
• Coverage sandbox versus production reach checks
• Wallet pilot week: hold and debit truth

Start with IOSOR

In Developers, mint a sandbox key, send one OTP on a consented test E.164, and export the ledger for that minute. Confirm zero hold and zero debit. Lock CI to that key id. Only then request a Live key for the pilot host, and revoke sandbox from any host that will carry Live traffic.

IOSOR takeaway

Sandbox credentials are a credit posture, not a softer Live key. Prove one OTP with zero hold and zero debit, lock CI to that key id, and only then mint Live for the pilot host — revoke sandbox from every host that will carry Live traffic.