Try it in a sandbox

You can give yourself a working EntryIdP tenant, register your own apps in it, and sign in to them — without asking anyone. It takes one face scan.

A sandbox is your own tenant on the Demo environment (https://idp-demo.entryidp.com) or the Test environment (https://idp-test.entryidp.com). It is not available on Production, where tenants are created for you.

Get one

1. Open {issuer}/tenant — for example https://idp-demo.entryidp.com/tenant.
2. New to EntryIdP? Choose New here? Create an account and your own sandbox, which takes you through enrolment. If you already have an EntryIdP account, either button works — see the tip below.
3. You will be offered a sandbox. Name it, and you land in it as its administrator.

That one scan does both: it signs you in and, when you confirm, creates the tenant. You will not be asked to scan again.

Already have an account?

Your existing EntryIdP account is the one that gets the sandbox — you do not create a separate developer login. If you already administer an organisation, you go straight to it and are not offered a sandbox.

Either button on that screen recognises a face we already know, so New here? never makes you enrol twice — it only changes what happens to a face we have not seen before. The two buttons appear only on Test and Demo; on Production there are no sandboxes, so tenants are created for you.

What you get

Your sandbox arrives with one app already registered, called Starter app. Its redirect URIs are already set to two addresses you can use immediately:

• {issuer}/dev-sample — the flow inspector we host, which walks through a real sign-in and shows you the authorization request, the code exchange and the claims that come back.
• http://localhost:5173/callback — the default address of a local Vite dev server.

So you can watch a real biometric sign-in complete, end to end, before you write anything. On the Apps tab, the ▶ action beside an app opens the flow inspector pointed at it.

When you are ready to wire up your own code, the integration panel on each app gives you its real client_id, issuer and redirect URI as copyable values, plus a prompt you can paste into an AI assistant. Then follow Integrate your app.

The limits

A sandbox is for proving an integration works, not for running a parallel environment. The current limits are:

How long	14 days, renewable once (from the Sandbox page of your own portal at {issuer}/me)
How many	One per person, ever. Deleting yours early still counts as having used it.
Apps	5, each with up to 3 redirect URIs and 3 web origins
People	10 sign-ups, ever — counting only people who enrol for the first time through your apps

Every refusal names which limit you hit and what to do about it. If you genuinely need more, ask us for a proper tenant rather than working around them.

The 10-person ceiling is the one worth understanding, because it is the only limit that cannot be reset: it counts face records, and a face record cannot be deleted once created. Someone who already has an EntryIdP account and signs in to your app does not use one of the ten — only a brand-new enrolment does.

What a sandbox cannot do

• Manage members. You can see who has signed in to your apps, but not assign their roles or block them. Those are real people's accounts on a shared platform, so acting on them needs a tenant we created.
• Assert verified identity. The identity_verified claim is not backed by a real identity check yet, on any environment. Do not build anything that trusts it.
• Become a production tenant. A sandbox app is never promoted. Going live means talking to us — which is the conversation we want to have.

Sandbox data is temporary and best-effort. It can be wiped. Don't build anything you need to keep.

When it expires

Three days before expiry we email you, and again when it expires — but only to a verified email address. Check yours on the Profile page of your own portal at {issuer}/me; an unverified address means no warning at all.

An expired sandbox stops issuing tokens the moment its clock passes, and is removed shortly afterwards. If it has not been renewed yet, you can still renew it from your portal after it has lapsed.

Next steps

• Integrate your app — guides and AI prompts per platform.
• Reference — every endpoint, scope, claim and token lifetime.
• Get a client — how to get a production tenant when you are ready.