Testers
Sandbox onlyReal people invited to try a sandbox application — the third way in, after the team and the test identities.
The third way into a sandbox application
A sandbox application signs in its team and its test identities. A tester is a real UnifyID account the team invites so that someone outside the team can try the application with their own verified identity before it goes to production.
An application may hold at most 25 live testers — invited or accepted — and a tester's access lasts 90 days. The cap is deliberate: a sandbox application with hundreds of real people in it is production without the review, and the honest answer to needing more is going live.
Inviting, listing, ending
POST /v1/developer/applications/{applicationId}/testers with { unifyId } invites by UnifyID. Any member of the team may invite.
GET …/testers lists the invitations and their states with limit, remaining and the testers themselves. DELETE …/testers/{testerId} ends one from your side; the person can do the same from their own connected applications.
The invited person opens the emailed link, sees the application's name and the fact that UnifyID has not reviewed it, and accepts or declines signed in as the account that was invited — holding the link is not enough.
What this does not do
- A tester is not a test identity. Their claims are their own real verified claims, released under a real consent they can revoke. Nothing about them is synthetic.
- A tester's sign-in counts toward `sandbox_sign_in`, like any sandbox token issuance; it does not count as production approval of anything.
Verified against API commit 234dba22 on 2026-10-18. The routes, scopes, checklist, events and limits on these pages are read from that export, not typed.