# Generate a credential (/en/docs/pix-processamento/sandbox/credencial)

<QuickLinks>
  <QuickLink href="/docs/pix-processamento/sandbox" title="Sandbox" />

  <QuickLink href="/docs/pix-processamento/sandbox/cenarios" title="Test scenarios" />

  <QuickLink href="/docs/pix-processamento/sandbox/webhooks" title="Webhooks in the sandbox" />

  <QuickLink href="/docs/pix-processamento/authentication" title="Authentication" />
</QuickLinks>

The sandbox credential is issued from an e-mail and a 6-digit code. There is no sign-up and no approval.

<Flow>
  <FlowNode title="E-mail" subtitle="no sign-up" />

  <FlowArrow label="6-digit code" />

  <FlowNode title="Verification" subtitle="10 min, 5 attempts" />

  <FlowArrow label="POST /sandbox/credentials/verify" />

  <FlowNode title="sbx_..." subtitle="24 hours" />
</Flow>

## Generate with the form [#generate-with-the-form]

<SandboxCredential
  labels="{
  emailLabel: &#x22;E-mail&#x22;,
  emailPlaceholder: &#x22;dev@yourstore.com&#x22;,
  requestCode: &#x22;Send code&#x22;,
  sending: &#x22;Sending...&#x22;,
  codeSent: &#x22;Code sent to {email}. It is valid for 10 minutes and allows 5 attempts.&#x22;,
  codeLabel: &#x22;6-digit code&#x22;,
  codePlaceholder: &#x22;000000&#x22;,
  generateCredential: &#x22;Generate credential&#x22;,
  generating: &#x22;Generating...&#x22;,
  changeEmail: &#x22;Use another e-mail&#x22;,
  tokenTitle: &#x22;Your sandbox credential&#x22;,
  tokenWarning: &#x22;Copy it now. The token will not be shown again and is valid for 24 hours.&#x22;,
  copy: &#x22;Copy&#x22;,
  copied: &#x22;Copied!&#x22;,
  copyFailed: &#x22;Copy failed&#x22;,
  curlsTitle: &#x22;First calls&#x22;,
  curlWebhook: &#x22;Register a webhook&#x22;,
  curlCharge: &#x22;Create a charge&#x22;,
  curlLookup: &#x22;Look up the charge&#x22;,
  webhookUrlPlaceholder: &#x22;https://your-app.com/webhook&#x22;,
  captchaLoading: &#x22;Loading reCAPTCHA...&#x22;,
  captchaError: &#x22;Could not load reCAPTCHA. Reload the page.&#x22;,
  captchaRequired: &#x22;Check the reCAPTCHA before requesting the code.&#x22;,
  networkError: &#x22;Could not reach the sandbox. Check your connection and try again.&#x22;,
  unexpectedError: &#x22;The sandbox returned an error without a message.&#x22;,
  retryAfter: &#x22;Try again in {seconds} second(s).&#x22;,
  requestIdLabel: &#x22;requestId&#x22;,
}"
/>

The code arrives by e-mail, is valid for 10 minutes and allows 5 attempts. Each e-mail can request up to 3 codes per hour. The credential starts with the `DEPOSIT` and `WITHDRAW` scopes, a balance of R$ 10,000.00 and zero fees. Send `Authorization: Bearer sbx_...` on authenticated calls, as in [Authentication](/docs/pix-processamento/authentication). The two pre-credential routes take no token: `POST /sandbox/credentials` (code request, protected by reCAPTCHA) and `POST /sandbox/credentials/verify` (code exchange for the credential).

<Callout type="warn">
  The token is shown only once. Store it as you would the production one: in an environment variable, outside the repository.
</Callout>

## Exchange the code with curl [#exchange-the-code-with-curl]

Requesting the code (`POST /sandbox/credentials`) requires the reCAPTCHA token, which is why the form above does it. Exchanging the code for the credential can be done with curl:

```bash
curl -X POST https://pix.sandbox.payzu.dev/sandbox/credentials/verify \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@sualoja.com.br","code":"418302"}'
```

```json
{
  "id": "cmh211yjm03ohs601kf7672du",
  "token": "sbx_5f3a9c2e...",
  "status": "ACTIVE",
  "permissions": ["DEPOSIT", "WITHDRAW"],
  "createdAt": "2026-08-23T12:00:00.000Z",
  "updatedAt": "2026-08-23T12:00:00.000Z"
}
```

Keep the `token` in `SANDBOX_TOKEN` for the next steps: [Test scenarios](/docs/pix-processamento/sandbox/cenarios) and [Webhooks in the sandbox](/docs/pix-processamento/sandbox/webhooks).