Generate a credential
From e-mail to the sbx_... credential in one minute: 6-digit code, DEPOSIT and WITHDRAW scopes, R$ 10,000.00 balance and 24-hour validity.
The sandbox credential is issued from an e-mail and a 6-digit code. There is no sign-up and no approval.
Generate with the form
The code arrives by e-mail, is valid for 10 minutes and allows 5 attempts. Each e-mail can request up to 3 codes per hour. The credential starts with the DEPOSIT and WITHDRAW scopes, a balance of R$ 10,000.00 and zero fees. Send Authorization: Bearer sbx_... on authenticated calls, as in Authentication. The two pre-credential routes take no token: POST /sandbox/credentials (code request, protected by reCAPTCHA) and POST /sandbox/credentials/verify (code exchange for the credential).
The token is shown only once. Store it as you would the production one: in an environment variable, outside the repository.
Exchange the code with curl
Requesting the code (POST /sandbox/credentials) requires the reCAPTCHA token, which is why the form above does it. Exchanging the code for the credential can be done with curl:
curl -X POST https://pix.sandbox.payzu.dev/sandbox/credentials/verify \
-H "Content-Type: application/json" \
-d '{"email":"dev@sualoja.com.br","code":"418302"}'{
"id": "cmh211yjm03ohs601kf7672du",
"token": "sbx_5f3a9c2e...",
"status": "ACTIVE",
"permissions": ["DEPOSIT", "WITHDRAW"],
"createdAt": "2026-08-23T12:00:00.000Z",
"updatedAt": "2026-08-23T12:00:00.000Z"
}Keep the token in SANDBOX_TOKEN for the next steps: Test scenarios and Webhooks in the sandbox.